Vulnerabilities

TI-2024-16991 CVE-2024-25876 · GHSA-pcm8-qqrp-w6qf

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1…

LOW 28

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2024-02-22 No fix listed CWE-79

TI-2024-16990 CVE-2024-25875 · GHSA-c579-hhw5-cr3p

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1…

MEDIUM 62

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00424 Published 2024-02-22 No fix listed CWE-79

TI-2024-16989 CVE-2024-25874 · GHSA-38m8-5gfc-663g

A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS…

MEDIUM 58

A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00397 Published 2024-02-22 No fix listed CWE-79

TI-2024-16988 CVE-2024-25873 · GHSA-v57p-q7g2-4g2r

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author…

MEDIUM 58

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00482 Published 2024-02-22 No fix listed CWE-80

TI-2018-06374 CVE-2018-8832 · GHSA-mfff-c82j-42cq

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the…

LOW 23

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00615 Published 2018-03-20 No fix listed CWE-79

Vulnerabilities

Filters

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1…

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1…

A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS…

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author…

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the…