Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the survey content and administration functionality of Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4. Authenticated remote users who have survey creation or edit privileges can inject malicious JavaScript code into survey content. When other users view this crafted survey content, the malicious script executes in their browsers, potentially stealing session information and allowing unauthorized actions to be performed on their behalf. This occurs because the application does not properly encode output before rendering the survey content.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers with certain privileges to execute arbitrary JavaScript in other users' browsers. This can lead to theft of session information, which may result in unauthorized access to user accounts or actions performed without the users' consent. It can compromise user data and the integrity of the application, potentially leading to further exploitation or data breaches.

Useful 0 Not Useful 0