An unauthenticated cross-site scripting flaw in Ajax30 BraveCMS-2.0 allows attackers to inject malicious HTML into administrator notification emails, creating significant phishing and credential harvesting risks.

This vulnerability is an improper input neutralization flaw (CWE-79) residing in the contact form handler, where unauthenticated user input is rendered via an unescaped Blade email template directive.

Successful exploitation allows attackers to manipulate administrative email content, potentially deceiving privileged users into interacting with malicious phishing interfaces. This introduces severe risks of credential theft and unauthorized access. The CVSS score of 7.1 highlights a high severity rating due to the potential for confidentiality and integrity impacts via user interaction.

Immediate Action: Update the BraveCMS-2.0 installation to commit 6c5660373cf5f0ca9181603280427aca46ef11ea or later where input sanitization is properly enforced.

Proactive Monitoring: Monitor outbound mail queues and contact form submission logs for anomalous or heavily formatted HTML payloads intended to deceive administrators.

Compensating Controls: Deploy a Web Application Firewall to inspect and filter suspicious contact form submissions containing raw HTML tags or script elements.

Public Exploit Available: No - there is no confirmed public exploit in the available data.

Administrators must treat this high severity vulnerability with urgency to prevent targeted phishing against privileged accounts. Applying the recommended upstream commit or security update immediately is critical to neutralizing the injection risk in the notification system.