CVE-2020-35416

🗓️ 15 Dec 2020 20:50:43Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 60 Views🌐 WEB

CVE-2020-35416: Multiple cross-site scripting (XSS) vulnerabilities in PHPJabbers Appointment Scheduler 2.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2020-35416	16 Dec 202000:40	–	circl
CNNVD	Phpjabbers Appointment Scheduler 跨站脚本漏洞	15 Dec 202000:00	–	cnnvd
CNVD	Phpjabbers Appointment Scheduler Cross-Site Scripting Vulnerability	17 Dec 202000:00	–	cnvd
Cvelist	CVE-2020-35416	15 Dec 202020:50	–	cvelist
Exploit DB	PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting)	17 Dec 202000:00	–	exploitdb
EUVD	EUVD-2020-23090	7 Oct 202500:30	–	euvd
NVD	CVE-2020-35416	15 Dec 202021:15	–	nvd
OSV	CVE-2020-35416	15 Dec 202021:15	–	osv
Packet Storm	PHPJabbers Appointment Scheduler 2.3 Cross Site Scripting	15 Dec 202000:00	–	packetstorm
Packet Storm	PHPJabbers Appointment Scheduler 2.3 Cross Site Scripting	17 Dec 202000:00	–	packetstorm

NVD

Node

onlineonly phpjabbers_appointment_schedulerMatch2.3

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/160600/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html
packetstormsecurity	www.packetstormsecurity.com/files/160502/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html
exploit-db	www.exploit-db.com/exploits/49281

Parameter	Position	Path	Description	CWE
date	query param	index.php	Reflected XSS in index.php login portal, exploitable via malicious query parameters (e.g., date) to inject script/HTML.	CWE-79
controller	query param	index.php	Reflected XSS in index.php login portal, exploitable via malicious query parameters (e.g., date) to inject script/HTML.	CWE-79
action	query param	index.php	Reflected XSS in index.php login portal, exploitable via malicious query parameters (e.g., date) to inject script/HTML.	CWE-79
layout	query param	index.php	Reflected XSS in index.php login portal, exploitable via malicious query parameters (e.g., date) to inject script/HTML.	CWE-79
cid	query param	index.php	Reflected XSS in index.php login portal, exploitable via malicious query parameters (e.g., date) to inject script/HTML.	CWE-79
theme	query param	index.php	Reflected XSS in index.php login portal, exploitable via malicious query parameters (e.g., date) to inject script/HTML.	CWE-79

21 Nov 2024 05:27Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24.3

CVSS 3.16.1

EPSS0.05165

cve-2020-35416 cross-site scripting xss phpjabbers appointment scheduler 2.3 security vulnerability remote attack