CVE-2020-35240

Name of the Vulnerable Software and Affected Versions FluxBB version 1.5.11

Description The issue allows an attacker to inject a cross-site scripting (XSS) payload in the "Blog Content" component. When any user visits the blog, the XSS triggers, enabling the attacker to steal cookies based on the crafted payload.

Recommendations For FluxBB version 1.5.11, consider disabling the "Blog Content" component until a patch is available to prevent the injection of XSS payloads. Restrict access to this component to minimize the risk of exploitation. Avoid using the "Blog Content" feature in a way that could allow an attacker to inject malicious scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.