| Package | Affected versions | Patched versions |
|---|---|---|
| symphony | < 3.3.0 | 3.3.0 |
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free