Descrição
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim-s browser. This has been fixed in 5.73.16 and 6.7.2.
CVSS 6.1EPSS 0.149%Risco 0.62
Ver fonte- Publicação
- 2026-03-27 21:17:25
- Versões afetadas
- <5.73.16,<6.7.2
- Tipo
- Core software
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N