CVE-2020-25761

Опубликовано: 30 сент. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc.

Ссылки

http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Sep/45
Exploit
Mailing List
Third Party Advisory
https://packetstormsecurity.com/files/author/15149/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/48830
http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Sep/45
Exploit
Mailing List
Third Party Advisory
https://packetstormsecurity.com/files/author/15149/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:projectworlds:visitor_management_system:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 62%

0.00434

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-ggrp-mmv9-mmpc