vendor:
JForum
by:
7.5
CVSS
HIGH
HTML Injection
79
CWE
Product Name: JForum
Affected Version From: 2.1.2008
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
HTML Injection in JForum
JForum is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Mitigation:
To mitigate this vulnerability, it is recommended to implement proper input sanitization and validation techniques to prevent the injection of malicious code.