CVE-2023-27206
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
Risk Assessment
An attacker could exploit this to execute malicious script in the victim's browser, potentially leading to data theft, session hijacking, or other harmful actions.
Recommendation
Apply patches provided by the vendor or secure the application against XSS, e.g., by validating and sanitizing input and using appropriate headers.
Other vulnerabilities in Best POS Management System
See all- CVE-2023-27205Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the month parameter at /kruxton/sales_report.php.
- CVE-2023-27204Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the id parameter at /kruxton/manage_user.php.
- CVE-2023-27203Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the id parameter at /billing/home.php.
- CVE-2023-27202Critical
Best POS Management System 1.0 contains a SQL injection vulnerability in the id parameter at /kruxton/receipt.php. An attacker can exploit this flaw to manipulate database queries.
- CVE-2023-0946Medium
A critical SQL Injection vulnerability in SourceCodester Best POS Management System 1.0. An unknown functionality in the file billing/index.php?id=9 allows manipulation of the id argument, leading to SQL injection. The attack can be launched remotely.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.