Medium severity4.8OSV Advisory· Published Jan 29, 2019· Updated Jun 17, 2026

CVE-2019-7168

Description

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
croogo/croogoPackagist	< 3.0.7	3.0.7

Affected products

Croogo/Croogo2 versions
cpe:2.3:a:croogo:croogo:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:croogo:croogo:*:*:*:*:*:*:*:*range: <=3.0.5
- (no CPE)range: 2.3.3, 3.0.0, 3.0.1, …
ghsa-coords
pkg:composer/croogo/croogo
Range: < 3.0.7

Patches

Vulnerability mechanics

References

github.com/croogo/croogo/issues/886nvdExploitIssue TrackingThird Party AdvisoryWEB
github.com/advisories/GHSA-9f9r-w3xq-f722ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2019-7168ghsaADVISORY
github.com/croogo/croogo/commit/cafaaabe2cef3d1d83652370e30563e6ad7c4158ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000