CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fazilatunnesa News Ticker newsticker allows Stored XSS.This issue affects News Ticker: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
News Ticker versions 1.0 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. When a victim visits a page containing the attacker's payload, the script executes in their browser with access to their session. The vulnerability affects the component's scope beyond itself, potentially compromising other parts of the application.
What an attacker can do
Inject malicious JavaScript that executes when other users view affected pages, stealing session data or performing actions on their behalf.
Potential impact on your site
Authenticated users' sessions and data can be compromised if they interact with attacker-controlled content in the News Ticker component.
Conditions required to exploit
Attacker must have a low-privilege user account and trick a victim into visiting a page containing the malicious payload.
Key dates
External resources
Related vulnerabilities
