| Package | Affected versions | Patched versions |
|---|---|---|
| contentserver | ≤ 5.6.2929 |
The WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent to admin/applets/wysiwyg/rendereditor.asp, which allows remote authenticated users to inject arbitrary JavaScript via a request to admin/worklist/worklist_edit.asp.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free