Medium severity · published Aug 4, 2023
CVE-2023-36158
Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TT
Toll Tax Management System · Oretnom23
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-36158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-36158
Exploit
https://cyberredteam.tech/posts/cve-2023-36158/
Exploit
https://github.com/unknown00759/CVE-2023-36158/blob/main/CVE-2023-36158.md
Product
https://www.sourcecodester.com/php/15304/toll-tax-management-system-phpoop-free-source-code.html
More from Toll Tax Management System
9.8
CVE-2022-30053
In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks
7.2
CVE-2023-44047
Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection
5.4
CVE-2024-51032
A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web…
5.4
CVE-2022-30837
Toll-tax-management-system v1.0 is vulnerable to Cross Site Scripting (XSS) via /ttms/classes/Master.php?f=save_recipient, vehicle_name