SilverStripe vulnerable to Cross-site Scripting

MEDIUM 4.3CVE-2010-1593 · GHSA-wg4m-vvp6-2hc5 · Published 28/04/2010 · updated 16/06/2026

In short

CVE-2010-1593 is a MEDIUM (CVSS 4.3) vulnerability affecting silverstripe/cms, silverstripe/framework, silverstripe (silverstripe).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.4% of all vulnerabilities.
Fix: update to 2.3.5 or later.

Package	Affected versions	Patched versions
silverstripe/cms Packagist	`< 2.3.5`	`2.3.5`
silverstripe/framework Packagist	`< 2.3.5`	`2.3.5`
silverstripe silverstripe	`= 2.0.0= 2.0.1= 2.0.2= 2.1.0= 2.1.1= 2.2.0= 2.2.1= 2.2.2= 2.2.4= 2.3.0= 2.3.1= 2.3.2= 2.3.3≤ 2.3.4`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).

NVD description

References

More vulnerabilities in silverstripe/cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free