CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JamRizzi Technologies Rizzi Guestbook rizzi-guestbook allows Reflected XSS.This issue affects Rizzi Guestbook: from n/a through <= 4.0.1.
Explanation of Vulnerability in Simple Terms
Rizzi Guestbook versions 4.0.1 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the guestbook. When a site visitor views a guestbook entry containing the injected code, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. The vulnerability affects the guestbook's input handling and can impact multiple users across the site.
What an attacker can do
Inject malicious JavaScript that executes when other users view guestbook entries, stealing cookies or performing unauthorized actions.
Potential impact on your site
Visitor sessions and data can be compromised; attackers can deface the guestbook or redirect users to malicious sites.
Conditions required to exploit
No authentication required. A victim must visit a page displaying the compromised guestbook entry.
Key dates
External resources
Related vulnerabilities
