CVE-2023-39714
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.
Risk Assessment
Attackers can exploit these vulnerabilities to hijack user sessions or steal data, posing a significant security threat to the organization.
Recommendation
It is recommended to update the system to the latest version and implement input filtering and validation to minimize the risk of XSS attacks.
Original NVD description (English source)
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.