Web Design
Monthly
Reflected XSS in Ceviz Informatics Inc.'s Web Design platform (versions through 25082026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script crosses the application-browser trust boundary, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and no CISA KEV listing; the threat is opportunistic phishing-driven rather than mass exploitation.
Reflected XSS in Ceviz Informatics Inc.'s Web Design platform (versions through 25082026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script crosses the application-browser trust boundary, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and no CISA KEV listing; the threat is opportunistic phishing-driven rather than mass exploitation.