A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.
GSA_kwCzR0hTQS05ZjlyLXczeHEtZjcyMs4AAUT6
Croogo vulnerable to XSS in Blog field
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:croogo/croogo | <= 3.0.5 | 3.0.7 | |
Affected Version RangesAll affected versions2.0.0, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 All unaffected versions3.0.6, 3.0.7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7 |
|||