{"action":"Upgrade plone to 5.2.4 or later.","affected":[{"fixed":"5.2.4","introduced":"0"}],"component":"plone","cve_ids":["CVE-2021-3313"],"ecosystem":"PyPI","epss":0.00978,"exploited":false,"fixed_versions":["5.2.4"],"ghsa_id":"GHSA-hprr-4vfq-fcxw","id":"tcs_01M5KGF64T3SMTK3T7XQ0NPTZF","modified_at":"2026-06-10T17:01:38.058787506Z","published_at":"2021-05-20T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-78","https://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt","https://plone.org/download/releases/5.2.3","https://plone.org/security/hotfix/20210518","http://www.openwall.com/lists/oss-security/2021/05/22/1","https://github.com/advisories/GHSA-hprr-4vfq-fcxw"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-78","url":"https://osv.dev/vulnerability/PYSEC-2021-78"}],"summary":"Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when"}