CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.
Explanation of Vulnerability in Simple Terms
Orbisius Simple Notice versions 1.1.3 and earlier contain a cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts that execute in other users' browsers when they view the notice. The vulnerability requires user interaction—the victim must visit a page displaying the notice. Impact is limited to low-severity data exposure and site defacement.
What an attacker can do
Inject JavaScript that runs in other users' browsers when they view a notice.
Potential impact on your site
Malicious admins can steal session tokens, deface notices, or redirect users to phishing sites.
Conditions required to exploit
Administrator account access; victim must view the affected notice.
Key dates
External resources
