CVE-2026-33883
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Résumé
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the user:reset_password_form tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov