Medium severity · published Dec 2, 2020
CVE-2020-29239
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS)
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the attacker can able to steal the cookie according to the crafted payload.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OV
Online Voting System · Janobe
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29239
Third Party Advisory
https://www.exploit-db.com/exploits/49159
More from Online Voting System
9.8
CVE-2023-43470
SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component