Brave CMS vulnerabilities

Brave CMS prior to commit 6c56603 had a publicly accessible contact form, allowing for the injection of unsafe HTML into email content. User-supplied message text was processed by the nl2br() function, which did not sanitize HTML, enabling attackers to create phishing interfaces in emails sent to the administrator.

Brave CMS prior to commit 6c56603 stored page and article body content entered by editor-role users through CKEditor verbatim in the database. As a result, any JavaScript or HTML injected by them was permanently stored and executed in every visitor's browser upon page load.

An IDOR vulnerability in the article image deletion feature in Brave CMS prior to 2.0.6. The deleteImage method in ArticleController.php accepts a filename from the URL without ownership verification, allowing an authenticated user with edit permissions to delete images attached to other users' articles.

In Brave CMS prior to 2.0.6, the update role endpoint lacks authorization checks, allowing any authenticated user to change roles and become Super Admin.