CVE-2023-28820

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was...

Original description

The description as published by the source.

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

References

advisory github.com
advisory nvd.nist.gov
advisory concretecms.org
package github.com