CVE-2023-39708
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
Risk Assessment
This vulnerability may lead to user data theft or session hijacking, posing a significant security risk to the organization.
Recommendation
It is recommended to update the system to the latest version that addresses this vulnerability and to implement appropriate input sanitization filters.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.