critical9.0
CVE-2022-37721
PyroCMS vulnerable to stored Cross Site Scripting
Impact
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS) when a low privileged user, such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | pyrocms/pyrocms | <= 3.9.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pyrocms | Pyrocms | Version 3.9 |