CVE-2023-36314
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update to the latest version of PHPJabbers Callback Widget and to validate and sanitize input data in the application.
Other vulnerabilities in PHPJabbers Callback Widget v1.0
See all- CVE-2023-40756Critical
User enumeration is found in PHPJabbers Callback Widget v1.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, enabling a brute force attack on valid users.
- CVE-2023-40755Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36315Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36312Medium
There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0. An attacker can exploit this vulnerability to inject malicious scripts.
Original NVD description (English source)
There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS