PyroCMS vulnerable to stored Cross Site Scripting

CRÍTICO 9.0CVE-2022-37721 · GHSA-cm7f-hf2g-ghrp · Published 25/11/2022 · updated 09/07/2026

En resumen

CVE-2022-37721 es una vulnerabilidad CRÍTICO (CVSS 9.0) que afecta a pyrocms/pyrocms, pyrocms (pyrocms).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.77%, mayor que el 55.6% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
pyrocms/pyrocms Packagist	`≤ 3.9.1`	No fix yet
pyrocms pyrocms	`= 3.9`	No fix yet

Description

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS) when a low privileged user, such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.

NVD description

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.

References

nvd.nist.gov/vuln/detail/CVE-2022-37721 · ADVISORY
pyrocms/pyrocms · PACKAGE
labs.integrity.pt/advisories/cve-2022-37721 · WEB
labs.integrity.pt/advisories/cve-2022-37721 · Third Party Advisory

Más vulnerabilidades de pyrocms/pyrocms

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pyrocms/pyrocms

Packagist

≤ 3.9.1

No fix yet

pyrocms

= 3.9

No fix yet

Description

NVD description

Más vulnerabilidades de pyrocms/pyrocms

Ver todo →