CVE-2023-0945
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability classified as problematic was found in SourceCodester Best POS Management System 1.0. An unknown function in the file index.php?page=add-category is affected. Manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross-site scripting. The attack can be launched remotely.
Risk Assessment
The risk is the possibility of executing malicious scripts in the browser of an administrator or user, which could lead to session theft, account takeover, or other attacks.
Recommendation
It is recommended to apply vendor patches or validate and sanitize input for the Name argument to prevent script injection.
Original NVD description (English source)
A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file index.php?page=add-category. The manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221592.