CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.
Explanation of Vulnerability in Simple Terms
Quiz And Survey Master versions up to 8.2.2 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into quiz or survey content that execute in the browsers of other users viewing those quizzes. The vulnerability requires an admin to craft the payload and a victim to view the affected content, but can compromise user sessions or steal data.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view quizzes or surveys.
Potential impact on your site
An admin account compromise could allow session hijacking or data theft from site visitors viewing quizzes.
Conditions required to exploit
Attacker must have administrator privileges and the victim must view the affected quiz or survey page.
Key dates
External resources
Related vulnerabilities
