Cross site scripting in getkirby/starterkit

MEDIO 5.4CVE-2022-35174 · GHSA-4m2g-668v-jwjx · Published 18/08/2022 · updated 17/06/2026

In breve

CVE-2022-35174 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda getkirby/starterkit, starterkit (getkirby).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.69%, superiore al 52.9% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
getkirby/starterkit Packagist	`≤ 3.7.0.2`	No fix yet
starterkit getkirby	`= 3.7.0.2`	No fix yet

Description

A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.

NVD description

A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.

References

nvd.nist.gov/vuln/detail/CVE-2022-35174 · ADVISORY
getkirby/starterkit · PACKAGE
owasp.org/www-community/attacks/xss · WEB
youtube.com/watch · WEB
owasp.org/www-community/attacks/xss · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free