Executive brief
OURPHP, a content management system, contains a security flaw in its user profile section. An attacker can inject malicious scripts into the 'Name' field of the user profile page. If an administrator or another user views this profile, the script could execute in their browser, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in OURPHP versions up to and including 8.6.1. The flaw is located in the 'Complete Profile' functionality within the 'My User Center' component, specifically affecting the 'Name' input field. An attacker can register an account via the front-end interface and submit a malicious payload in the name field. Because the application fails to properly neutralize this input before rendering it in the web page, the script executes in the context of any user who views the affected profile. This is tracked as CWE-79 and requires minimal user interaction to trigger.
Affected products
- OURPHP OURPHP thru 8.6.1
Timeline
- 2025-08-14: advisory: Initial NVD publication date