CVE-2020-35240

CVE-2020-35240 describes a Cross-Site Scripting (XSS) vulnerability in FluxBB version 1.5.11, specifically within the "Blog Content" component. An attacker can inject malicious script into blog content, which then executes in the browser of any user viewing the blog, potentially leading to cookie theft. The vulnerability is rated Medium (CVSS 4.8), requiring high privileges (PR:H) and user interaction (UI:R) for successful exploitation, with a potential impact of limited confidentiality and integrity compromise. The attack vector is network-based (AV:N) with low attack complexity (AC:L). There is currently no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has received minimal community discussion or media coverage, suggesting low public awareness and a lack of widespread attention.