Cross-Site Scripting (XSS) / Stored / Non-Admin to Admin about vulnerability-rating-taxonomy HOT 2 CLOSED

@Brucedh It doesn't really matter if the payload executes only in the backend, it will still fall into 'to anyone' variant. Being able to run malicious scripts in administrative context is equally impactful as in any other context, in some situations depending on the domain configuration it may even have more impact.
What is an important risk limiting factor is the level of privilege required to inject the payload, that's why non-admin variant is rated higher.
I will not be able to answer why this particular example you are referring to was marked as P4, perhaps it required multiple steps to trigger the payload that were unlikely to happen. Either way if you have a working PoC of an XSS that you are able to inject into administrative context as a regular user, that would be initially considered P2 according to the VRT based on Non-Admin to Anyone variant. After further analysis it could get downgraded because of necessary prerequisites.
Hope that helps!

from vulnerability-rating-taxonomy.

Perfect, got it!
Thank you

from vulnerability-rating-taxonomy.