CVE-2023-36309
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Document Creator v1.0.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update to the latest version of PHPJabbers Document Creator to mitigate this vulnerability and implement proper input sanitization filters.
Other vulnerabilities in PHPJabbers Document Creator v1.0
See all- CVE-2023-40758Critical
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- CVE-2023-36311Critical
In version 1.0 of PHPJabbers Document Creator, there is a SQL injection (SQLi) vulnerability in the 'column' parameter of index.php.
- CVE-2023-36313Medium
PHPJabbers Document Creator version 1.0 is vulnerable to Cross Site Scripting (XSS) via all POST parameters of 'Export Requests' except for 'request_feed'.
- CVE-2023-36310Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'column' parameter of index.php in PHPJabbers Document Creator v1.0.
Original NVD description (English source)
There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Document Creator v1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS