CyberRota Analysis
AI-GeneratedMettle SendPortal versions 3.0.1 and earlier are susceptible to a stored cross-site scripting (XSS) vulnerability due to inadequate input sanitization in the template management feature. This flaw allows attackers to inject malicious JavaScript code, which can be executed in the browsers of users accessing the compromised templates, potentially leading to data theft or session hijacking. Organizations using affected versions should prioritize remediation to protect their users from these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject malicious JavaScript code that is executed in the browsers of users who access the affected template.