CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Login Page lh-login-page allows Reflected XSS.This issue affects LH Login Page: from n/a through <= 2.14.
Explanation of Vulnerability in Simple Terms
LH Login Page versions 2.14 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the login page. When a victim visits a crafted link, the injected code executes in their browser, potentially stealing credentials or session tokens. The vulnerability affects all users of the product.
What an attacker can do
Inject malicious JavaScript that runs in a victim's browser when they visit the login page.
Potential impact on your site
Users' login credentials and session tokens can be stolen; attackers may gain unauthorized access to accounts.
Conditions required to exploit
Victim must click a malicious link or visit a crafted URL pointing to the vulnerable login page.
Key dates
External resources
Related vulnerabilities
