CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weissmike Simple Finance Calculator simple-finance-calculator allows Reflected XSS.This issue affects Simple Finance Calculator: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
Simple Finance Calculator versions 1.0 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker can craft a malicious link or page that, when visited by a user, executes arbitrary JavaScript in the victim's browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the user.
What an attacker can do
Execute JavaScript code in a user's browser to steal session tokens, credentials, or perform actions as that user.
Potential impact on your site
Users visiting the application are at risk of account compromise, data theft, or malware infection if an attacker distributes a malicious link.
Conditions required to exploit
The victim must visit a malicious link or page containing the injected payload while logged into or using the application.
Key dates
External resources
Related vulnerabilities
