PyroCMS vulnerable to stored Cross Site Scripting

CRITICAL 9.0CVE-2022-37721 · GHSA-cm7f-hf2g-ghrp · Published 25/11/2022 · updated 09/07/2026

Package	Affected versions	Patched versions
pyrocms/pyrocms Packagist	`≤ 3.9.1`	No fix yet
pyrocms pyrocms	`= 3.9`	No fix yet

Description

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS) when a low privileged user, such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.

NVD description

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.

References

nvd.nist.gov/vuln/detail/CVE-2022-37721 · ADVISORY
pyrocms/pyrocms · PACKAGE
labs.integrity.pt/advisories/cve-2022-37721 · WEB
labs.integrity.pt/advisories/cve-2022-37721 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free