Crypto-Cat

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 5.0.0-RC1 through 5.9.22 Craft CMS versions 4.0.0-RC1 through 4.17.15 **Description** An attacker with a GitHub account can inject a JavaScript payload into a craftcms/cms issue title. The payload executes within the control panel session of a Craft admin when they use the CraftSupport widget Give feedback screen and enter a search term that retrieves the poisoned issue. This process requires no control panel account or elevated privileges from the attacker. **Recommendations** Update to version 5.9.23. Update to version 4.17.16.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 5.0.0-RC1 through 5.9.22 **Description** A stored cross-site scripting issue exists where a user with author-level control panel permissions can embed a malicious JavaScript payload within an entry title. The execution occurs when an administrator or a user with `saveEntries` permissions for the same Structure section performs a drag operation on another entry under the affected entry in the table view. This happens because the server escapes the title into `data-title`, which the browser decodes and jQuery reads via `.data('title')`, subsequently concatenating it into a new HTML string without proper attribute escaping. Successful exploitation requires the attacker to have at least an Author role and the victim to perform a specific drag action while possessing elevated session privileges. **Recommendations** Update to version 5.9.23.