CVE-2021-36150: 
PHP vulnerability analysis and mitigation

SilverStripe Framework through version 4.8.1 was affected by a Cross-Site Scripting (XSS) vulnerability. The vulnerability was disclosed on October 5, 2021, and affected the SilverStripe admin module versions ^1.0, with fixes released in versions ^1.8.1 and ^1.9.0 (Silverstripe Security).

The vulnerability was classified as a reflective (self) cross-site scripting issue with a Medium severity rating and a Base CVSS score of 4.0. The vulnerability existed in a specific CMS form field where if a user could be tricked into pasting HTML containing script tags, it would allow arbitrary JavaScript execution within the user's browser (Silverstripe Security).

If successfully exploited, the vulnerability could allow attackers to execute arbitrary JavaScript code in the context of the user's browser session. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks against CMS users (CVE Mitre).

The recommended mitigation is to upgrade to the fixed versions: silverstripe/admin ^1.8.1 or ^1.9.0. No alternative workarounds were provided in the security advisory (Silverstripe Security).