CVE-2026-32986
Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection
概要
Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- report packetstorm.news
- web textpattern.com