{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.4.9"}],"component":"craftcms/cms","cve_ids":["CVE-2023-33495"],"ecosystem":"Packagist","epss":0.00497,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m3v5-gjj9-rg24","id":"tcs_01M5KF53G8MQKNVEZNHMJB7ZD8","modified_at":"2026-09-10T03:50:08.407151103Z","published_at":"2023-06-20T15:31:08Z","references":["https://osv.dev/vulnerability/GHSA-m3v5-gjj9-rg24","https://nvd.nist.gov/vuln/detail/CVE-2023-33495","https://github.com/craftcms/cms","https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212","https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-m3v5-gjj9-rg24","url":"https://osv.dev/vulnerability/GHSA-m3v5-gjj9-rg24"}],"summary":"Craft CMS vulnerable to HTML injection"}