CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Reflected XSS.This issue affects Survey Maker: from n/a through 4.0.6.
Explanation of Vulnerability in Simple Terms
Survey Maker versions up to 4.0.6 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into survey pages. When a victim visits a crafted survey link, the attacker's code runs in their browser, potentially stealing session data or performing actions on their behalf. No authentication is required to exploit this vulnerability.
What an attacker can do
Inject malicious JavaScript into survey pages to steal user data or perform actions in victims' browsers.
Potential impact on your site
Survey responses and user sessions at risk; attackers can harvest credentials or redirect users to phishing sites.
Conditions required to exploit
Victim must visit a crafted survey link; no authentication required.
Key dates
External resources
Related vulnerabilities
