PyroCMS vulnerable to stored Cross Site Scripting

CRITICO 9.0CVE-2022-37721 · GHSA-cm7f-hf2g-ghrp · Published 25/11/2022 · updated 09/07/2026

In breve

CVE-2022-37721 è una vulnerabilità CRITICO (CVSS 9.0) che riguarda pyrocms/pyrocms, pyrocms (pyrocms).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.77%, superiore al 55.6% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
pyrocms/pyrocms Packagist	`≤ 3.9.1`	No fix yet
pyrocms pyrocms	`= 3.9`	No fix yet

Description

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS) when a low privileged user, such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.

NVD description

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.

References

nvd.nist.gov/vuln/detail/CVE-2022-37721 · ADVISORY
pyrocms/pyrocms · PACKAGE
labs.integrity.pt/advisories/cve-2022-37721 · WEB
labs.integrity.pt/advisories/cve-2022-37721 · Third Party Advisory

Altre vulnerabilità di pyrocms/pyrocms

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pyrocms/pyrocms

Packagist

≤ 3.9.1

No fix yet

pyrocms

= 3.9

No fix yet

Description

NVD description

Altre vulnerabilità di pyrocms/pyrocms

Vedi tutto →