CVE-2010-1593

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-04-28 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).

Affected products

Silverstripe: through 2.3.4; 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1, 2.2.0 (+12)

References

http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0450.html
http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456
http://open.silverstripe.org/changeset/97074
http://open.silverstripe.org/wiki/ChangeLog/2.3.5
http://osvdb.org/61921
http://osvdb.org/61923
http://secunia.com/advisories/38290
http://secunia.com/advisories/38347
http://www.securityfocus.com/archive/1/509139/100/0/threaded
http://www.securityfocus.com/bid/37923
http://www.silverstripe.org/security-releases/
https://exchange.xforce.ibmcloud.com/vulnerabilities/55838

Get alerted when CVE-2010-1593 or the next vulnerability affects your stack