CVE-2023-36289

MediumCVSS 6.1

Published: 23/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.12%

62th percentile - higher than 62% of all known CVEs

Summary

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie. This enables the attacker to impersonate that user via POST email_create and back parameter.

Risk Assessment

This vulnerability poses a risk of session hijacking, which can lead to unauthorized access to user accounts and data. Organizations should be aware of the potential consequences related to data security.

Recommendation

It is recommended to update Webkul QloApps to the latest version to mitigate this vulnerability. Additionally, implementing XSS protection mechanisms and monitoring logs for suspicious activities is advisable.

Original NVD description (English source)

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.