CVE-2020-28727

48th percentile - higher than 48% of all known CVEs

A Cross-Site Scripting (XSS) vulnerability was discovered in SeedDMS 6.0.13 via the folderid parameter in views/bootstrap/class.DropFolderChooser.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.

The risk includes potential session hijacking, data theft, or phishing attacks within the SeedDMS application context. This could compromise the confidentiality and integrity of data stored in the system.

Immediately update SeedDMS to the latest available version that includes a fix for the XSS vulnerability. If an update is not possible, implement server-side filtering and validation of the folderid parameter.