Description
Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Edito | Edito CMS | 0 <5.10.2607 | — |