CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to inject malicious scripts into comment bodies, which are then rendered in the browsers of other users, including administrators. This stored cross-site scripting (XSS) flaw can lead to session token theft and unauthorized actions, posing a significant risk to user accounts and system integrity. Organizations using parallax filament-comments version 3.0.0 or earlier should prioritize remediation to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.