CVE-2020-36012
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A stored XSS vulnerability was found in BDTASK Multi-Store Inventory Management System 1.0. A local admin can inject arbitrary JavaScript code via the Customer Name field.
Risk Assessment
An attacker could hijack user sessions, steal data, or perform other malicious actions within the application context, compromising system confidentiality and integrity.
Recommendation
Update the system to the latest version and implement input validation and encoding for the Customer Name field to prevent script injection.
Other vulnerabilities in BDTASK Multi-Store Inventory Management System
See all- CVE-2026-10172Medium
Vulnerability in Bdtask Multi-Store Inventory Management System 1.0 allows unrestricted file upload by manipulating the module argument in the Upload function of the file application/modules/dashboard/controllers/Module.php.
- CVE-2026-10155Medium
Vulnerability in Bdtask Multi-Store Inventory Management System 1.0 allows SQL Injection by manipulating the dtpToDate argument in the accounts_report_search function of the file application/modules/accounts/controllers/Accounts.php.
Original NVD description (English source)
Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS