CVE-2023-36138
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
PHPJabbers Cleaning Business Software version 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.
Risk Assessment
Exploitation of this vulnerability could lead to user data theft or session hijacking, posing a serious security threat to the application.
Recommendation
It is recommended to update the software to the latest version and to validate and sanitize input data to minimize the risk of XSS.
Other vulnerabilities in PHPJabbers Cleaning Business Software 1.0
See all- CVE-2023-36139Critical
In PHPJabbers Cleaning Business Software version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.
- CVE-2023-36141Medium
User enumeration is found in PHPJabbers Cleaning Business Software version 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Original NVD description (English source)
PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.