CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Stored XSS.This issue affects Lenix scss compiler: from n/a through <= 1.2.
Explanation of Vulnerability in Simple Terms
The Lenix SCSS compiler versions 1.2 and earlier contain a cross-site scripting vulnerability in how it processes SCSS input. An attacker with high privileges can inject malicious scripts that execute in the browser of users who interact with compiled output. The vulnerability requires user interaction and affects the integrity and confidentiality of affected sites.
What an attacker can do
Inject malicious scripts that run in users' browsers when they view compiled SCSS output.
Potential impact on your site
Users viewing pages with compiled SCSS from this tool may have their sessions compromised or data stolen via injected scripts.
Conditions required to exploit
Attacker must have high-level privileges on the system and the victim must interact with the affected content.
Key dates
External resources
Related vulnerabilities
