CVE-2020-25761

MEDIUM

Projectworlds Visitor Management System - XSS

Title source: rule

Description

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc.

Exploits (1)

exploitdb WORKING POC

by Rahul Ramkumar · pythonwebappsphp

https://www.exploit-db.com/exploits/48830

View Code ZIP pw:eip

References (4)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0-Cross-Site-Scripting.html

[Exploit, Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2020/Sep/45

[Exploit, Third Party Advisory, VDB Entry] https://packetstormsecurity.com/files/author/15149/

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/48830

Scores

CVSS v3 6.1

EPSS 0.0043

EPSS Percentile 62.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

projectworlds/visitor_management_system 1.0

Published Sep 30, 2020

Tracked Since Feb 18, 2026