CVE-2011-4958

Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/.

• CWE-79

• http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12
• http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6
• http://osvdb.org/76258
• http://secunia.com/advisories/46390Vendor Advisory
• http://www.rul3z.de/advisories/SSCHADV2011-024.txtExploit
• http://www.securityfocus.com/archive/1/520050/100/0/threaded
• https://github.com/silverstripe/sapphire/commit/16c3235Exploit, Patch
• https://github.com/silverstripe/sapphire/commit/52a895fExploit, Patch
• https://github.com/silverstripe/sapphire/commit/bdd6391Exploit, Patch
• http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12
• http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6
• http://osvdb.org/76258
• http://secunia.com/advisories/46390Vendor Advisory
• http://www.rul3z.de/advisories/SSCHADV2011-024.txtExploit
• http://www.securityfocus.com/archive/1/520050/100/0/threaded
• https://github.com/silverstripe/sapphire/commit/16c3235Exploit, Patch
• https://github.com/silverstripe/sapphire/commit/52a895fExploit, Patch
• https://github.com/silverstripe/sapphire/commit/bdd6391Exploit, Patch

Published

Apr 8, 2014

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4952cobbler: Web interface lacks CSRF protection when using Djan…8.8
• CVE-2011-4953The set_mgmt_parameters function in item.py in cobbler befor…
• CVE-2011-4954cobbler has local privilege escalation via the use of insecu…7.8
• CVE-2011-4955Multiple cross-site scripting (XSS) vulnerabilities in ui_st…
• CVE-2011-4956Cross-site scripting (XSS) vulnerability in WordPress before…
• CVE-2011-4957The make_clickable function in wp-includes/formatting.php in…
• CVE-2011-4959SQL injection vulnerability in the addslashes method in Silv…
• CVE-2011-4960SQL injection vulnerability in the Folder::findOrMake method…
• CVE-2011-4961SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allo…
• CVE-2011-4962code/sitefeatures/PageCommentInterface.php in SilverStripe 2…
• CVE-2011-4963nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allo…
• CVE-2011-4964Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…