CVE-2021-27969: 
NixOS vulnerability analysis and mitigation

Dolphin CMS version 7.4.2 was found to contain a stored Cross-Site Scripting (XSS) vulnerability in the Page Builder feature. The vulnerability was discovered in March 2021 and assigned identifier CVE-2021-27969. The issue specifically affects the 'width' parameter in the Page Builder component (CVE Mitre, NVD).

The vulnerability exists in the Page Builder functionality where the 'width' parameter is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code through the 'other pages width' field by setting values like '1081pxalert(document.cookie)' which gets stored and later executed (Exploit DB).

When successfully exploited, this stored XSS vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers who view the affected page. This could lead to cookie theft, session hijacking, or other client-side attacks (Exploit DB).

The vulnerability requires an attacker to have administrative access to the CMS to exploit the issue. The attack can be performed by accessing the Pages Builder section in the admin panel and manipulating the width parameter through intercepted requests (Exploit DB).

Users should upgrade to a version newer than Dolphin CMS 7.4.2 that contains patches for this vulnerability. If upgrading is not immediately possible, administrators should restrict access to the Page Builder functionality and carefully monitor any changes to page width parameters (CVE Mitre).