{"action":"Upgrade plone to 4.1.1 or later.","affected":[{"fixed":"4.1.1","introduced":"0"}],"component":"plone","cve_ids":["CVE-2011-1948"],"ecosystem":"PyPI","epss":0.02389,"exploited":false,"fixed_versions":["4.1.1"],"ghsa_id":"GHSA-p7h9-vf92-5fj5","id":"tcs_01M5KG5FP9T0DRXJRZG3RRWFRQ","modified_at":"2026-07-13T16:43:05.701859834Z","published_at":"2011-06-06T19:55:00Z","references":["https://osv.dev/vulnerability/PYSEC-2011-14","http://secunia.com/advisories/44776","http://www.securityfocus.com/bid/48005","http://secunia.com/advisories/44775","http://plone.org/products/plone/security/advisories/CVE-2011-1948","http://osvdb.org/72727","http://securityreason.com/securityalert/8269","https://exchange.xforce.ibmcloud.com/vulnerabilities/67693","http://www.securityfocus.com/archive/1/518155/100/0/threaded","https://github.com/advisories/GHSA-p7h9-vf92-5fj5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2011-14","url":"https://osv.dev/vulnerability/PYSEC-2011-14"}],"summary":"Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL."}