In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.

Published Aug 16, 2021 · Updated Aug 4, 2024 · Assigned by mitre