Q Smart Next Poll
Monthly
Stored cross-site scripting in Bifra Engineering Consulting Ltd. Q-smart NexT Poll (all versions before 1.8.7) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into poll content that executes in the browsers of any user who subsequently views the affected page. The scope change (S:C in CVSS) indicates impact extends beyond the submitting user to other authenticated or unauthenticated viewers, enabling session hijacking, credential theft, or unauthorized actions performed in the victim's browser context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in Bifra Engineering Consulting Ltd. Q-smart NexT Poll (all versions before 1.8.7) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into poll content that executes in the browsers of any user who subsequently views the affected page. The scope change (S:C in CVSS) indicates impact extends beyond the submitting user to other authenticated or unauthenticated viewers, enabling session hijacking, credential theft, or unauthorized actions performed in the victim's browser context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.