CVE-2020-37240

EIP tracks 1 public exploit for CVE-2020-37240. PoCs published by Kislay Kumar.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Queue Management System 4.0.0 by injecting a malicious payload into user input fields, which executes when viewed in the user list.

Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user creation fields. Attackers can insert JavaScript payloads in the First Name, Last Name, and Email fields during user creation, which execute when viewing the User List page.