Total vulnerabilities in the database
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
| Software | From | Fixed in |
|---|---|---|
| b3log / symphony | - | 3.3.0 |