Cross-site Scripting (XSS)

2024-03-2807:26:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

phpmyfaq

input validation

post request

javascript code

news page

software

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

5.6

Confidence

High

EPSS

Percentile

9.0%

JSON

phpMyFAQ is vulnerable to Cross-site Scripting (XSS). The vulnerability is due to inadequate input validation of the “news” parameter in a POST request, allowing an attacker to inject malicious JavaScript code. Upon visiting the compromised news page, the XSS payload is triggered.