Cross site scripting in getkirby/starterkit

MITTEL 5.4CVE-2022-35174 · GHSA-4m2g-668v-jwjx · Published 18/08/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-35174 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in getkirby/starterkit, starterkit (getkirby).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.69%, höher als bei 52.9% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
getkirby/starterkit Packagist	`≤ 3.7.0.2`	No fix yet
starterkit getkirby	`= 3.7.0.2`	No fix yet

Description

A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.

NVD description

A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.

References

nvd.nist.gov/vuln/detail/CVE-2022-35174 · ADVISORY
getkirby/starterkit · PACKAGE
owasp.org/www-community/attacks/xss · WEB
youtube.com/watch · WEB
owasp.org/www-community/attacks/xss · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free