Mateishomepage Website
Monthly
Reflected cross-site scripting in the users.php script of coolbeans1212's MateisHomePage-Website lets remote, unauthenticated attackers inject arbitrary JavaScript into a page rendered to a victim who opens a crafted link. A successful attack requires the victim to click an attacker-supplied URL containing a payload in the 'search' GET parameter (CVSS:4.0 UI:P), so the flaw is non-persistent and must be delivered per victim rather than planted once. Publicly available exploit code exists and the issue has been publicly disclosed alongside a vendor commit, but there is no evidence of confirmed active exploitation (no CISA KEV listing); the independently assessed risk is LOW despite the network attack vector, because the product is a niche personal website and impact is limited to script execution in the victim's browser session (C:L/I:L, S:C).
Reflected cross-site scripting in the users.php script of coolbeans1212's MateisHomePage-Website lets remote, unauthenticated attackers inject arbitrary JavaScript into a page rendered to a victim who opens a crafted link. A successful attack requires the victim to click an attacker-supplied URL containing a payload in the 'search' GET parameter (CVSS:4.0 UI:P), so the flaw is non-persistent and must be delivered per victim rather than planted once. Publicly available exploit code exists and the issue has been publicly disclosed alongside a vendor commit, but there is no evidence of confirmed active exploitation (no CISA KEV listing); the independently assessed risk is LOW despite the network attack vector, because the product is a niche personal website and impact is limited to script execution in the victim's browser session (C:L/I:L, S:C).