CVE-2023-39708
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
Risk Assessment
This vulnerability may lead to user data theft or session hijacking, posing a significant security risk to the organization.
Recommendation
It is recommended to update the system to the latest version that addresses this vulnerability and to implement appropriate input sanitization filters.
Other vulnerabilities in Free and Open Source Inventory Management System v1.0
See all- CVE-2023-39714Medium
Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.
- CVE-2023-39710Medium
Multiple cross-site scripting (XSS) vulnerabilities in the Inventory Management System v1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.
- CVE-2023-39709Medium
Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.
- CVE-2023-39707Medium
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add Expense parameter under the Expense section.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS