Every CVESearch/Get API key

GHSA-hhvj-mcrx-3vcf

silverstripe/framework has Cross-site Scripting vulnerability in page name

6.1 MediumFix available

silverstripe/framework is vulnerable to XSS in Page name where the payload "><svg/onload=alert(/xss/)> will trigger an XSS alert.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

What each source reports

GitHub Advisories Score used6.1

silverstripe/framework has Cross-site Scripting vulnerability in page name

silverstripe/framework is vulnerable to XSS in Page name where the payload "><svg/onload=alert(/xss/)> will trigger an XSS alert.

Record
GHSA-hhvj-mcrx-3vcf
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV6.1

silverstripe/framework has Cross-site Scripting vulnerability in page name

silverstripe/framework is vulnerable to XSS in Page name where the payload "><svg/onload=alert(/xss/)> will trigger an XSS alert.

Record
GHSA-hhvj-mcrx-3vcf
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
silverstripe/framework
Packagist
3.4.0-rc1 up to 3.4.4
3.4.4
silverstripe/framework
Packagist
3.5.0-rc1 up to 3.5.2
3.5.2
silverstripe/framework
Packagist
3.4.0-rc1 up to 3.4.4, plus listed versions
3.4.03.4.13.4.1-rc13.4.1-rc23.4.23.4.33.4.3-rc13.4.4-rc1
3.4.4
silverstripe/framework
Packagist
3.5.0-rc1 up to 3.5.2, plus listed versions
3.5.03.5.0-rc23.5.0-rc33.5.13.5.1-rc13.5.1-rc23.5.2-rc1
3.5.2

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-hhvj-mcrx-3vcf is a medium vulnerability (CVSS 6.1) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.4.4.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open