| Package | Affected versions | Patched versions |
|---|---|---|
| wbce cms | = 1.6.1 |
WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script content in the content parameter to execute JavaScript when users view the affected page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free