CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bryan Hadaway Site Favicon allows Stored XSS.This issue affects Site Favicon: from n/a through 0.2.
Explanation of Vulnerability in Simple Terms
Site Favicon contains a cross-site scripting (XSS) vulnerability that allows an authenticated administrator to inject malicious scripts into the site's favicon settings. When a victim visits the site or views the affected page, the injected script executes in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
Inject and execute malicious JavaScript in visitors' browsers via the favicon settings.
Potential impact on your site
An admin account compromise could allow an attacker to inject malware or steal visitor session data.
Conditions required to exploit
Attacker must have administrator privileges and the victim must visit the affected page or site.
Key dates
External resources
Related vulnerabilities
