CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
Explanation of Vulnerability in Simple Terms
Survey Maker versions up to 5.1.8.8 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into survey pages. When a site visitor views a compromised survey, the attacker's code runs in their browser, potentially stealing session data or redirecting them to phishing sites. The vulnerability requires user interaction—the victim must visit a crafted survey link.
What an attacker can do
Inject malicious JavaScript that runs when site visitors view a survey, stealing cookies or redirecting users.
Potential impact on your site
Visitors to your surveys could have their sessions hijacked or be redirected to malicious sites without your knowledge.
Conditions required to exploit
No authentication required. Victim must visit a link to a survey containing the injected payload.
Key dates
External resources
Related vulnerabilities
