CVE-2026-34748: Payload: siteler arası betik çalıştırma (XSS)

Açıklama (NVD)

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.

Özet bilgiler

Ürün

Payloadcms Payload

CVSS v3.1

8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS

%0,29 (yüzdelik 22)

CWE

CWE-79

Yama

Geçici çözüm

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• CWE-79