Vulnerabilities

TI-2021-16278 CVE-2021-38708 · GHSA-v6fx-fhrc-hc8m

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.

LOW 25

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00466 Published 2021-08-16 No fix listed CWE-79

TI-2021-16279 CVE-2021-38709 · GHSA-4v6c-4429-5c64

LOW 28

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00581 Published 2021-08-16 No fix listed CWE-79

TI-2018-04798 CVE-2018-6518 · GHSA-xxcj-mmq5-mg5m

LOW 23

Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00769 Published 2018-04-26 No fix listed CWE-79