CVE Catalog
CVE-2023-36287
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk1.15%
63th percentile - higher than 63% of all known CVEs
Summary
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
Risk Assessment
This vulnerability poses a risk of session hijacking, which could lead to unauthorized access to user accounts and data.
Recommendation
It is recommended to update Webkul QloApps to the latest version to mitigate this vulnerability and implement additional security measures against XSS attacks.
Original NVD description (English source)
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.