CVE-2015-8766 - CVE House

Back to Database

Status published Medium CVE-2015-8766

Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS...

6.1 CVSS

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-8766

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from getsymphony

View All →

A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php...

Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote...

content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to...

content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content...

Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to...

Affected Vendor

getsymphony

View all reports →

Affected Software

symphony

Vulnerable Versions:

0

Timeline

Official Publish: January 8th, 2016

Last Modified: August 6th, 2024

Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.