CVE-2023-36312
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0. An attacker can exploit this vulnerability to inject malicious scripts.
Risk Assessment
Exploitation of this vulnerability may lead to user data theft or session hijacking, posing a serious threat to the application's security and the organization's data.
Recommendation
It is recommended to update PHPJabbers Callback Widget to the latest version that fixes this vulnerability and to implement appropriate input sanitization filters.
Other vulnerabilities in PHPJabbers Callback Widget v1.0
See all- CVE-2023-40756Critical
User enumeration is found in PHPJabbers Callback Widget v1.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, enabling a brute force attack on valid users.
- CVE-2023-40755Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36315Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36314Medium
There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
Original NVD description (English source)
There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS