CVE-2018-11512

Name of the Vulnerable Software and Affected Versions Creatiwity wityCMS version 0.6.1

Description A stored cross-site scripting (XSS) issue exists in the 'Website's name' field of the 'Settings' page under the 'General' menu. This allows remote attackers to inject arbitrary web script or HTML via a crafted website name by sending an authenticated POST HTTP request to the "admin/settings/general" endpoint.

Recommendations For Creatiwity wityCMS version 0.6.1, as a temporary workaround, consider validating and sanitizing user input for the website name variable to prevent XSS attacks. Restrict access to the 'Settings' page under the 'General' menu to minimize the risk of exploitation.