CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through <= 2.5.1.
Explanation of Vulnerability in Simple Terms
Doppler Forms versions 2.5.1 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. When a victim visits a page containing the injected payload, the script executes in their browser with their privileges. The vulnerability affects the form rendering or data handling logic and can impact confidentiality, integrity, and availability.
What an attacker can do
Inject malicious JavaScript that executes when other users view affected forms, potentially stealing session tokens or modifying form data.
Potential impact on your site
Users' browsers can be compromised when viewing forms created or modified by attackers with low-level access; session hijacking or data tampering is possible.
Conditions required to exploit
Attacker must have a low-privilege account on the site and the victim must visit a page containing the malicious payload.
Key dates
External resources
