CVE-2020-29230
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Panel - Manage User tab via the Full Name field. An attacker can inject a malicious JavaScript payload during user registration, which triggers when the admin visits the manage user section, potentially stealing session cookies.
Risk Assessment
The risk involves potential theft of the admin's session cookies, which could lead to account takeover and full system compromise.
Recommendation
Immediately update the system to the latest version or implement input validation and output encoding for the Full Name field to prevent script injection.
Original NVD description (English source)
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each time admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie according to the crafted payload.