SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to cross-site scripting inside the href attribute of an HTML hyperlink, which can be added to website content via XMLHttpRequest (XHR) by an authenticated CMS user.
{ "nvd_published_at": "2022-06-29T01:15:00Z", "github_reviewed_at": "2022-06-29T22:12:39Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-79" ] }