Azrul Ikhwan Zulkifli

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 3.5.8 **Description** The issue concerns the writer field in Kirby, which stores formatted content as HTML code and does not escape HTML special characters against cross-site scripting (XSS) attacks. This allows malicious HTML code to be injected into the content file and executed in the browsers of site visitors and logged-in users. The vulnerability can be exploited by attackers who are in the group of authenticated Panel users, potentially leading to escalated privileges if they gain access to an admin user's Panel session. The estimated number of potentially affected devices is not specified. **Recommendations** For versions prior to 3.5.8, update to Kirby 3.5.8 or a later version to fix the vulnerability. As a temporary workaround, consider restricting access to the writer field for authenticated Panel users to minimize the risk of exploitation. If possible, avoid using the writer field until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 3.5.8 **Description** The issue concerns Kirby's blocks field, which stores structured data for each block, and this data is used in block snippets to convert blocks to HTML for use in templates. The default snippet for the image block did not escape HTML special characters, making it possible to include malicious HTML code in the source, alt, and link fields of the image block. This code would then be displayed on the site frontend and executed in the browsers of site visitors and logged-in users. Attackers must be authenticated Panel users to exploit this weakness. The vulnerability allows for cross-site scripting (XSS) attacks, which can execute JavaScript code inside the site frontend or Panel session of other users. **Recommendations** For versions prior to 3.5.8, update to Kirby version 3.5.8 or a later version to fix the vulnerability. As a temporary workaround, consider escaping HTML special characters in the output from the default image block snippet or using a custom block snippet that either escapes the printed values or doesn't use them. Restrict access to the blocks field, especially the image block, to minimize the risk of exploitation. Avoid using the `source`, `alt`, and `link` fields in the image block until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions prior to 3.7.14 **Description** The issue allows CSV injection, which can trigger a payload in old versions of Excel under certain circumstances. This can occur when exporting data in CSV format from element index pages, especially if user input from untrusted sources is accepted and there's a chance users will open the CSV file in old Excel versions. **Recommendations** For versions prior to 3.7.14, update to version 3.7.14 to resolve the issue. As a temporary workaround, consider avoiding the export of user-input data in CSV format from element index pages, especially if it will be opened in old versions of Excel. Restrict access to untrusted user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** flatCore versions prior to 1.5.7 **Description** The issue allows for XSS by an admin via specific parameters in the "acp/acp.php" endpoint, including `page linkname`, `page title`, `page content`, or `page extracontent` when editing a page, or `prefs pagename`, `prefs pagetitle`, or `prefs pagesubtitle` when setting system preferences. **Recommendations** For versions prior to 1.5.7, update to version 1.5.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the "acp/acp.php" endpoint, specifically the `tn=pages&sub=edit` and `tn=system&sub=sys pref` sections, to minimize the risk of exploitation. Avoid using the vulnerable parameters `page linkname`, `page title`, `page content`, `page extracontent`, `prefs pagename`, `prefs pagetitle`, or `prefs pagesubtitle` in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** flatCore versions prior to 1.5.7 **Description** The issue allows an admin to upload and execute a .php file. **Recommendations** For versions prior to 1.5.7, update to version 1.5.7 or later to resolve the issue.