CVE-2020-35240

MEDIUM

FluxBB 1.5.11 - Stored Cross-Site Scripting in Blog Content

Title source: llm
STIX 2.1

Description

FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://fluxbb.org/downloads/
Third Party Advisory x_refsource_misc
https://github.com/hemantsolo/CVE-Reference/issues/1

Scores

CVSS v3 4.8
EPSS 0.0102
EPSS Percentile 58.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
fluxbb/fluxbb 1.5.11
Published Dec 30, 2020
Tracked Since Feb 18, 2026