CVE-2023-39707
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add Expense parameter under the Expense section.
Risk Assessment
This vulnerability could lead to user data theft or session hijacking, posing a significant security threat to the organization.
Recommendation
It is recommended to update the system to the latest version and implement input validation to minimize the risk of XSS attacks.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add Expense parameter under the Expense section.