CVE-2022-29005
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Multiple cross-site scripting (XSS) vulnerabilities were found in the /obcs/user/profile.php component of Online Birth Certificate System v1.2. Attackers can inject malicious JavaScript or HTML via the fname or lname parameters, leading to arbitrary script execution in the victim's browser.
Risk Assessment
The risk includes session hijacking, account takeover, or unauthorized actions performed in the victim's session context. This could result in data leakage and system integrity compromise.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input filtering and validation (e.g., using htmlspecialchars) for the fname and lname parameters.
Original NVD description (English source)
Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters.