CyberRota Analysis
AI-GeneratedEch0 versions prior to 4.7.3 are vulnerable to a stored cross-site scripting (XSS) flaw in the public RSS feed, allowing attackers with admin privileges to inject malicious tag names or raw HTML. This can lead to the execution of arbitrary JavaScript in RSS readers that render HTML summaries, potentially impacting anonymous subscribers and other users. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.