CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored XSS.This issue affects Add Code To Head: from n/a through <= 1.17.
Explanation of Vulnerability in Simple Terms
Add Code To Head versions 1.17 and earlier contain a cross-site scripting vulnerability. An authenticated administrator with high privileges can inject malicious scripts into the site's head section. The vulnerability requires user interaction and affects the integrity and confidentiality of site data. Update to a version newer than 1.17.
What an attacker can do
Inject malicious JavaScript that executes in visitors' browsers when they view the site.
Potential impact on your site
Malicious scripts injected by admins could steal visitor data, deface pages, or redirect users.
Conditions required to exploit
Attacker must be an authenticated administrator. A user must visit an affected page.
Key dates
External resources
Related vulnerabilities
