{"id":"CVE-2011-1340","aliases":["PYSEC-2026-896"],"url":"https://o3.security/vulnerability/CVE-2011-1340","summary":"Plone XSS Vulnerability","details":"Cross-site scripting (XSS) vulnerability in `skins/plone_templates/default_error_message.pt` in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to `Members/ipa/createObject`.","published":"2022-05-17T05:40:10Z","modified":"2026-07-07T11:56:14.812245471Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"plone","fixedVersion":"2.5.3"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1340"},{"type":"WEB","url":"https://web.archive.org/web/20110816092954/http://dev.plone.org/plone/changeset/12262"},{"type":"WEB","url":"https://web.archive.org/web/20110817133423/https://dev.plone.org/plone/ticket/6110"},{"type":"WEB","url":"http://jvn.jp/en/jp/JVN41222793/index.html"},{"type":"WEB","url":"http://jvndb.jvn.jp/jvndb/JVNDB-2011-000056"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-07T11:56:14.812245471Z"}}