CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.4.
Explanation of Vulnerability in Simple Terms
Namaste! LMS versions 2.6.4 and earlier contain a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into the application. A logged-in user must visit a crafted link or page for the attack to execute. The vulnerability can affect other users and compromise site integrity or steal session data.
What an attacker can do
Inject malicious scripts that execute in other users' browsers and steal session data or modify site content.
Potential impact on your site
Attackers can steal admin or user session tokens, deface content, or redirect visitors to malicious sites.
Conditions required to exploit
Attacker needs a low-privilege account and must trick a user into visiting a malicious link.
Key dates
External resources
Related vulnerabilities
