CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevynCJohnson BBCode Deluxe bbcode-deluxe allows DOM-Based XSS.This issue affects BBCode Deluxe: from n/a through <= 2020.08.01.2.
Explanation of Vulnerability in Simple Terms
BBCode Deluxe contains a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into content. When a victim views the affected content, the script executes in their browser with access to their session. The vulnerability requires user interaction and affects confidentiality, integrity, and availability of the site.
What an attacker can do
Inject malicious scripts that execute when other users view the content, potentially stealing session tokens or modifying page content.
Potential impact on your site
Authenticated users can inject XSS payloads affecting other visitors; impacts site integrity and user trust.
Conditions required to exploit
Attacker must have a low-privilege account and the victim must view the page containing the injected script.
Key dates
External resources
Related vulnerabilities
