CVE-2020-15263

HIGH

Orchid Platform 9.0.0-9.4.3 - Cross-Site Scripting via Inline Attribute Injection

Title source: llm
STIX 2.1

Description

In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.

References (2)

Core 2

Scores

CVSS v3 8.0
EPSS 0.0074
EPSS Percentile 50.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Details

CWE
CWE-79
Status published
Products (2)
orchid/platform 9.0.0 - 9.4.4
orchid/platform 9.0.0 - 9.4.4Packagist
Published Oct 19, 2020
Tracked Since Feb 18, 2026