razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.

Published Sep 12, 2018 · Updated Aug 5, 2024 · Assigned by mitre