Soy Gallery
Monthly
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.