{"id":"GHSA-79hv-pfx6-hhpj","aliases":["CVE-2021-28088"],"title":"Cross-site scripting (XSS)","description":"Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the \"Display Name\" field.","severity":"medium","score":null,"published":"2021-03-12T21:34:02.000Z","modified":"2023-11-08T04:05:28.152Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"impresscms/impresscms","ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.4.2"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-28088","https://hackerone.com/reports/1119296","https://anotepad.com/note/read/s3kkk6h7"],"sources":[{"name":"OSV","id":"GHSA-79hv-pfx6-hhpj","modified":"2023-11-08T04:05:28.152861Z","url":"https://osv.dev/vulnerability/GHSA-79hv-pfx6-hhpj"}],"assessments":[]}