Diba Carousel Slider
Monthly
Stored cross-site scripting in the Drupal contributed module Diba carousel slider (versions 0.0.0 through 3.0.2) allows an authenticated user who can create or edit content rendered by the module to persist a script payload that executes in the browser of another user who views the affected page. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), the attacker must already hold content-authoring privileges and a separate victim must interact with the page, and the resulting impact is limited to the victim's browser session with no availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix; the priority signal places remediation in the current monthly maintenance cycle rather than an emergency response.
Stored cross-site scripting in the Drupal contributed module Diba carousel slider (versions 0.0.0 through 3.0.2) allows an authenticated user who can create or edit content rendered by the module to persist a script payload that executes in the browser of another user who views the affected page. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), the attacker must already hold content-authoring privileges and a separate victim must interact with the page, and the resulting impact is limited to the victim's browser session with no availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix; the priority signal places remediation in the current monthly maintenance cycle rather than an emergency response.