CVE-2023-40755
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Callback Widget v1.0.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update the Callback Widget to the latest version and to validate and sanitize input data in parameters.
Other vulnerabilities in PHPJabbers Callback Widget v1.0
See all- CVE-2023-40756Critical
User enumeration is found in PHPJabbers Callback Widget v1.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, enabling a brute force attack on valid users.
- CVE-2023-36315Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36314Medium
There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36312Medium
There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0. An attacker can exploit this vulnerability to inject malicious scripts.
Original NVD description (English source)
There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0.