CVE-2021-40541

Name of the Vulnerable Software and Affected Versions PHPFusion version 9.03.110

Description The issue is related to cross-site scripting (XSS) in the preg patterns filter html tag without "//" in the descript() function. An authenticated user can trigger XSS by appending "//" at the end of the text.

Recommendations For PHPFusion version 9.03.110, consider disabling the descript() function until a patch is available to prevent exploitation. Restrict access to the html tag filter to minimize the risk of XSS attacks. Avoid appending "//" at the end of text in the affected function to prevent triggering the issue.