CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in melipayamak Melipayamak melipayamak allows Stored XSS.This issue affects Melipayamak: from n/a through <= 2.2.12.
Explanation of Vulnerability in Simple Terms
Melipayamak versions up to 2.2.12 contain a cross-site scripting (XSS) vulnerability that allows an authenticated administrator to inject malicious scripts. The vulnerability requires user interaction—typically a victim clicking a crafted link—and can affect other users or the site itself. The impact is limited to low-severity data exposure and site defacement.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they visit affected pages.
Potential impact on your site
A compromised admin account could deface pages or steal session data from other admins or users.
Conditions required to exploit
Attacker must have high-level admin privileges and the victim must click a malicious link or visit a crafted page.
Key dates
External resources
Related vulnerabilities
