{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.8.1"}],"component":"craftcms/cms","cve_ids":["CVE-2023-30130"],"ecosystem":"Packagist","epss":0.01416,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fjx5-xm7q-whvj","id":"tcs_01M5KF1W7H33VHM3Z6JR6647JB","modified_at":"2025-01-24T20:23:21.783762Z","published_at":"2023-05-12T12:30:19Z","references":["https://osv.dev/vulnerability/GHSA-fjx5-xm7q-whvj","https://nvd.nist.gov/vuln/detail/CVE-2023-30130","https://craftcms.com","https://github.com/craftcms/cms","https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-fjx5-xm7q-whvj","url":"https://osv.dev/vulnerability/GHSA-fjx5-xm7q-whvj"}],"summary":"CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter"}