PT-2023-26091 · Unknown · Maid Hiring Management System

CVE-2023-37746 · Publicado 2023-07-13 · Atualizado 2023-11-14

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Maid Hiring Management System version 1.0

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter of the "/admin/contactus.php" component.

Recommendations For Maid Hiring Management System version 1.0, consider disabling the /admin/contactus.php component until a patch is available, or restrict access to this component to minimize the risk of exploitation. Avoid using the Title parameter in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-37746

Produtos afetados

Maid Hiring Management System

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-37746 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37746 · Nota de Segurança
• https://t.me/cvenotify/54865 · Publicação no Telegram
• https://t.me/cvenotify/54279 · Publicação no Telegram
• https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql · Nota