CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through <= 3.4.0.
Explanation of Vulnerability in Simple Terms
Magic the Gathering Card Tooltips versions 3.4.0 and earlier contain a cross-site scripting vulnerability in tooltip rendering. An authenticated user can inject malicious scripts that execute in other users' browsers when they view affected tooltips. The vulnerability requires user interaction and can affect site confidentiality, integrity, and availability.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view tooltips.
Potential impact on your site
Authenticated users can inject scripts affecting other visitors' sessions, potentially stealing data or modifying site content.
Conditions required to exploit
Attacker must be authenticated with low privileges; victim must view a page with the malicious tooltip.
Key dates
External resources
Related vulnerabilities
