CVE-2011-4340: Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions befor...

Security readout for executives and security teams

Symphony CMS 2.2.3, and possibly earlier versions before 2.2.4, allowed logged-in users with Author privileges to inject script or HTML into certain CMS paths. This could let a low-privileged content user affect other users viewing affected pages, but the provided sources do not show active exploitation. Exposure is most likely in legacy Symphony CMS deployments running 2.2.3 or older 2.2.x versions, especially where Author accounts are available to less-trusted users. Systems not running Symphony CMS are not implicated by the provided sources. Treat this as a targeted legacy CMS risk, not a broad internet emergency. Prioritize if Symphony CMS is still in production, if Author accounts are broadly assigned, or if the CMS supports sensitive customer-facing content. Mitigation focus: Upgrade Symphony CMS deployments to 2.2.4 or later where applicable.; Review vendor release guidance before applying changes to production systems.; Limit Author privileges to trusted users until affected systems are remediated..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.