CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cxc-sawa Management-screen-droptiles cxc-sawa allows Reflected XSS.This issue affects Management-screen-droptiles: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
Management-screen-droptiles versions 1.0 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a victim's browser when they visit a crafted link or page. The vulnerability affects the integrity and confidentiality of user data, and impacts site availability. Scope is changed, meaning the attack can affect resources beyond the vulnerable component.
What an attacker can do
Inject malicious scripts that run in a victim's browser to steal data, modify page content, or disrupt site functionality.
Potential impact on your site
Users visiting crafted links could have their sessions compromised, data stolen, or see modified content. Site availability may be affected.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page. No authentication required.
Key dates
External resources
