CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AMP-MODE Login Logo Editor allows Stored XSS.This issue affects Login Logo Editor: from n/a through 1.3.3.
Explanation of Vulnerability in Simple Terms
Login Logo Editor versions up to 1.3.3 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into the logo editor that execute in the browsers of other users viewing the login page. The vulnerability requires administrator privileges and user interaction to exploit, but can affect multiple site visitors.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they view the login page.
Potential impact on your site
Attackers with admin access can steal login credentials or session tokens from site visitors.
Conditions required to exploit
Administrator account access and victim must visit the affected login page.
Key dates
External resources
Related vulnerabilities
