CVE-2020-26680
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
Risk Assessment
An attacker can steal sessions, credentials, or redirect users to malicious sites, compromising the confidentiality and integrity of event participant data.
Recommendation
Immediately update vFairs to the latest version and implement input filtering and encoding to prevent HTML/JavaScript injection.
Original NVD description (English source)
In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.