CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.
Explanation of Vulnerability in Simple Terms
ARForms Form Builder versions up to 1.7.1 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form data. An attacker with network access can craft malicious input that gets stored and executed in users' browsers when they view the affected form. This vulnerability does not require authentication or user interaction from the attacker.
What an attacker can do
Inject malicious scripts that execute in users' browsers when they interact with forms.
Potential impact on your site
Users viewing or submitting forms may have their sessions hijacked, credentials stolen, or be redirected to malicious sites.
Conditions required to exploit
Network access to the form; no authentication required.
Key dates
External resources
Related vulnerabilities
