CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through <= 1.2.1.
Explanation of Vulnerability in Simple Terms
Visual Text Editor versions 1.2.1 and earlier contain a code injection vulnerability that allows authenticated users to run arbitrary code on the site. An attacker with low-level account access can inject and execute malicious code through the editor, potentially compromising the entire installation. The vulnerability affects all confidentiality, integrity, and availability of the system.
What an attacker can do
Run arbitrary code on the site with the privileges of the web server.
Potential impact on your site
Any authenticated user can execute code and take full control of your site, steal data, or destroy content.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
