PT-2026-4649 · Unknown · Click2Magic

Shivam Verma · Publicado 2026-01-25 · Atualizado 2026-01-25 · CVE-2020-36931

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Click2Magic version 1.1.5

Description The software contains a stored cross-site scripting issue that allows attackers to inject malicious scripts through the chat name input. An attacker can create a malicious payload within the chat name to obtain administrator cookies when the administrator handles user requests. The vulnerable input is the chat name. The attack involves capturing administrator cookies.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user-supplied input for the chat name field to prevent script injection.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-36931

Produtos afetados

Click2Magic

Referências · 6

• 🔥 https://exploit-db.com/exploits/49347 · Exploit
• https://vulncheck.com/advisories/clickmagic-stored-cross-site-scripting · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36931 · Nota de Segurança
• https://click2magic.com · Nota
• https://click2magic.com/user/agent/index · Nota
• https://t.me/cveNotify/149803 · Publicação no Telegram