CVE-2023-36313
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
PHPJabbers Document Creator version 1.0 is vulnerable to Cross Site Scripting (XSS) via all POST parameters of 'Export Requests' except for 'request_feed'.
Risk Assessment
Exploitation of this vulnerability could lead to user data theft or session hijacking, posing a serious security threat to the application.
Recommendation
It is recommended to update to the latest version of the software and to validate and sanitize all input data to minimize the risk of XSS.
Other vulnerabilities in PHPJabbers Document Creator v1.0
See all- CVE-2023-40758Critical
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- CVE-2023-36311Critical
In version 1.0 of PHPJabbers Document Creator, there is a SQL injection (SQLi) vulnerability in the 'column' parameter of index.php.
- CVE-2023-36310Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'column' parameter of index.php in PHPJabbers Document Creator v1.0.
- CVE-2023-36309Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Document Creator v1.0.
Original NVD description (English source)
PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "request_feed".
Vulnerability data from NVD (NIST) · CISA KEV · EPSS