CVE-2019-11406

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1

Description The issue allows for XSS attacks via the name, email, or phone parameter in the core/en/contacts/ endpoint.

Recommendations For Subrion CMS version 4.2.1, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting user input for the name, email, and phone parameters to minimize the risk of exploitation.