GHSA-74j9-xhqr-6qv3
Reflected Cross Site Scripting (XSS) in error message
GHSA-74j9-xhqr-6qv3 is a vulnerability with no CVSS score yet in silverstripe/framework, published January 23, 2025. No source lists public exploit code. Fixed in silverstripe/framework 5.3.8.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.3.8silverstripe/framework +1 more
Description
If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | before 5.3.8 | 5.3.8 |
silverstripe/frameworkPackagist | before 5.3.8, plus listed versions 2.4.102.4.112.4.122.4.132.4.9 Show 45 moreShow less2.5.03.0.103.0.10-rc13.0.113.0.11-rc13.0.123.0.133.0.143.0.2.13.0.33.0.3-rc13.0.3-rc23.0.43.0.53.0.63.0.6-rc13.0.6-rc23.0.73.0.7-rc13.0.83.0.93.0.9-rc13.1.03.1.0-beta13.1.0-beta23.1.0-beta33.1.0-rc13.1.0-rc23.1.0-rc33.1.13.1.103.1.10-rc13.1.10-rc23.1.113.1.11-rc13.1.123.1.133.1.13-rc13.1.143.1.14-rc13.1.153.1.163.1.16-rc13.1.173.1.17-rc1 | 5.3.8 |
What each source reports
GitHub AdvisoriesNo score
Reflected Cross Site Scripting (XSS) in error message
If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.
- Record
GHSA-74j9-xhqr-6qv3- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Reflected Cross Site Scripting (XSS) in error message
If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.
- Record
GHSA-74j9-xhqr-6qv3- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 392 versions. The JSON record has them.