CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through <= 2.3.8.
Explanation of Vulnerability in Simple Terms
Image Editor by Pixo versions 2.3.8 and earlier contain a cross-site scripting vulnerability. An attacker with low-level access can inject malicious scripts that execute in other users' browsers when they interact with the editor. The vulnerability requires user interaction and can affect confidentiality, integrity, and availability of the affected site.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they use the image editor.
Potential impact on your site
Users' sessions could be compromised, data stolen, or site functionality disrupted through injected scripts.
Conditions required to exploit
Attacker needs low-level user account access; victim must interact with the editor interface.
Key dates
External resources
Related vulnerabilities
