p PatchFirst

CVE-2020-15263

CVE-2020-15263 · XSS in platform

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.

CVSS 8.0 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • platform

    Versions
    • >= 9.0.0, < 9.4.4: Affected

    No fix published

  • orchid/platform Packagist

    Versions
    • 9.0.0
    • 9.0.1
    • 9.0.2
    • 9.0.3
    • 9.1.0
    • 9.1.1
    • 9.2.0
    • 9.3.0
    • 9.4.0
    • 9.4.1
    • 9.4.2
    • 9.4.3
    Affected ranges
    • ECOSYSTEM: ≥ 9.0.0, < 9.4.4

    Update to 9.4.4

Original sources

Check your server →