Description
Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to admin/preview.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | elefant/cms | >= 1.0, < 1.0.2-Beta | 1.0.2-Beta | GHSA-qjjq-rcq8-jw6j |
| Packagist | elefant/cms | >= 1.1, < 1.1.5-Beta | 1.1.5-Beta | GHSA-qjjq-rcq8-jw6j |