https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 18:11:45 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55779 <p>Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem-&gt;Title, $restoredItem-&gt;URLSegment, $restoredItem-&gt;CMSEditLink(), and $changedProperty[&#39;value&#39;] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator&#39;s browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1.</p> <p>Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem-&gt;Title, $restoredItem-&gt;URLSegment, $restoredItem-&gt;CMSEditLink(), and $changedProperty[&#39;value&#39;] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator&#39;s browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55779 https://vulnerability.circl.lu/vuln/ghsa-m4g4-86qc-v8w7 <p><strong>Affected:</strong> Packagist: silverstripe/versioned</p> <p>### Impact It&#39;s possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin</p> <p>### Reporter Steve Boyd Silverstripe Ltd.</p> <p><strong>Affected:</strong> Packagist: silverstripe/versioned</p> <p>### Impact It&#39;s possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin</p> <p>### Reporter Steve Boyd Silverstripe Ltd.</p> https://vulnerability.circl.lu/vuln/ghsa-m4g4-86qc-v8w7