{"id":"GHSA-xjr9-2wf2-3v4w","aliases":["CVE-2014-9120"],"title":"Subrion CMS Cross-site scripting in search","description":"A cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the `PATH_INFO` to `subrion/search/`.","severity":"medium","score":null,"published":"2022-05-14T02:00:54.000Z","modified":"2023-11-08T03:57:46.393Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"intelliants/subrion","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.2.3"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["3.2.3"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2014-9120","https://www.netsparker.com/xss-vulnerability-in-subrion-cms","http://dev.subrion.org/versions/130"],"sources":[{"name":"OSV","id":"GHSA-xjr9-2wf2-3v4w","modified":"2023-11-08T03:57:46.393612Z","url":"https://osv.dev/vulnerability/GHSA-xjr9-2wf2-3v4w"}],"assessments":[]}