Description
Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Edito | Edito CMS | 0 <5.10.2607 | — |