CVE-2022-37721
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
PyroCMS 3.9 is vulnerable to a stored XSS attack, allowing a low-privileged user (e.g., author) to inject malicious HTML and JavaScript into blog post content. This can lead to full admin account takeover or privilege escalation.
Risk Assessment
An attacker can gain full control over an admin account, resulting in unauthorized data access, content modification, or complete compromise of the CMS system.
Recommendation
Immediately upgrade PyroCMS to the latest version that fixes this vulnerability. Additionally, implement input filtering and output encoding for all content fields.
Original NVD description (English source)
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.