Typesetter CMS Reflected XSS via Editing.php

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Typesetter CMS 跨站脚本漏洞

Typesetter CMS是Typesetter开源的一个内容管理系统。 Typesetter CMS 5.1及之前版本存在跨站脚本漏洞，该漏洞源于对images参数清理和转义不足，可能导致反射型跨站脚本攻击。

N/A

N/A