An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username.

An issue was discovered in Gentics CMS before 5.43.1. By uploading a malicious ZIP file, an attacker is able to deserialize arbitrary data and hence can potentially achieve Java code execution.