CVE-2015-1040

CVE-2015-1040 describes multiple cross-site scripting (XSS) vulnerabilities found in the administrative backend of BEdita 3.4.0. Specifically, authenticated users can inject malicious web scripts or HTML through various input fields across different forms within the application. This vulnerability has a CVSS score of 3.5, indicating a medium attack complexity and requiring authentication, but it can lead to information disclosure (C:N/I:P/A:N). While not actively exploited in the wild according to KEV, its EPSS score is low, suggesting a low probability of exploitation. Despite no known public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, with 5 mentions, including a reference to Chinese state-sponsored hackers exploiting 25 vulnerabilities, though not specifically this one.