CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through < 9.11.1.
Explanation of Vulnerability in Simple Terms
AcyMailing SMTP Newsletter versions 9.11.1 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a victim's browser when they visit a crafted page or click a malicious link. The vulnerability affects the newsletter component and can compromise user sessions or steal sensitive data.
What an attacker can do
Inject and execute malicious JavaScript in a victim's browser to steal session data or perform actions on their behalf.
Potential impact on your site
Users visiting affected pages may have their sessions hijacked or personal data stolen; site reputation and user trust at risk.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page that triggers the vulnerability.
Key dates
External resources
Related vulnerabilities
