CVE-2019-12186 describes a Cross-Site Scripting (XSS) vulnerability in Sylius products, specifically sylius/sylius and sylius/grid, across multiple versions. This flaw stems from missing input sanitization, allowing an authenticated administrator to inject malicious code into grid fields of "string" type. The vulnerability has a CVSS v3.1 score of 4.8 (Medium), indicating a network-based attack with low complexity, requiring high privileges and user interaction, leading to low impact on confidentiality and integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.0.0, <= 1.0.18CPE matchmatch criteria | cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:* | ||
>= 1.1.0, <= 1.1.18CPE matchmatch criteria | cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:* | ||
>= 1.2.0, <= 1.2.17CPE matchmatch criteria | cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:* | ||
>= 1.3.0, <= 1.3.12CPE matchmatch criteria | cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:* | ||
>= 1.4.0, <= 1.4.4CPE matchmatch criteria | cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.