Orta CVSS 6.1
CVE-2026-113659: CVE-2026-113659: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.
Özet bilgiler
- CVSS v3.1
- 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS
- %0,35 (yüzdelik 28)
- CWE
- CWE-79
- Yama
- Yok / bilinmiyor