CVE-2019-16684

CVE-2019-16684 describes a stored cross-site scripting (XSS) vulnerability in the image-manager component of Xoops version 2.5.10. An authenticated attacker with privileges to upload images can embed a JavaScript payload within an image's filename. This payload executes when a user hovers over the malicious image in the image list or edit page. This vulnerability has a CVSS score of 4.8 (Medium), indicating a low attack complexity but requiring high privileges and user interaction. The potential impact includes limited confidentiality and integrity compromise, as an attacker could execute arbitrary scripts in the victim's browser. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting low public awareness and limited attacker interest.