parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
parallax:filament-comments
References 5
https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering
HackIndex: Stored XSS in parallax/filament-comments through unescaped comment rendering
https://github.com/parallax/filament-comments/blob/3.0.0/resources/views/commen…
NVD
https://github.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentC…
NVD
https://packagist.org/packages/parallax/filament-comments
NVD
https://www.vulncheck.com/advisories/parallax-filament-comments-through-3.0.0-s…
VulnCheck Advisory: parallax filament-comments through 3.0.0 Stored XSS via Comment Body