CVE-2023-36139
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In PHPJabbers Cleaning Business Software version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.
Risk Assessment
Account takeover by an attacker may lead to unauthorized access to user data and potential financial losses for the organization.
Recommendation
It is recommended to implement identity verification mechanisms when changing email addresses and passwords to minimize the risk of account takeover.
Other vulnerabilities in PHPJabbers Cleaning Business Software 1.0
See all- CVE-2023-36141Medium
User enumeration is found in PHPJabbers Cleaning Business Software version 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- CVE-2023-36138Medium
PHPJabbers Cleaning Business Software version 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.
Original NVD description (English source)
In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.