CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.8 are susceptible to a stored cross-site scripting vulnerability in the control panel, where draft names are improperly rendered without HTML encoding. This flaw allows low-privilege users to inject malicious JavaScript, which can execute in the browsers of higher-privileged users, potentially leading to unauthorized account creation and other actions. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.