CVE-2023-36137
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Class Scheduling System 1.0.
Risk Assessment
An attacker can exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to validate and sanitize input data in the 'theme' parameter and to update to the latest version of the software.
Other vulnerabilities in PHPJabbers Class Scheduling System 1.0
See all- CVE-2023-36136Medium
PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account, allowing an attacker to capture all user names and passwords in clear text.
- CVE-2023-36135High
User enumeration is found in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Original NVD description (English source)
There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS