datenstrom/yellow

datenstrom/yellow

GitHubGitHub
GitHubgithub.com
datenstrom.sedatenstrom.se
Releases0
Stars456
Datenstrom Yellow is for people who make small websites.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2018-10758↗
—5.8 MEDIUM

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles.

CVE-2018-10726↗
5.4 MEDIUM3.5 LOW

A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS