CVE-2020-24198

A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'
Configurations

Configuration 1 (hide)

cpe:2.3:a:stock_management_system_project:stock_management_system:1.0:*:*:*:*:*:*:*

History

21 Nov 2024, 05:14

Type Values Removed Values Added
References () https://cxsecurity.com/issue/WLB-2020090024 - Exploit, Third Party Advisory () https://cxsecurity.com/issue/WLB-2020090024 - Exploit, Third Party Advisory
References () https://www.sourcecodester.com/php/14366/stock-management-system-php.html - Product () https://www.sourcecodester.com/php/14366/stock-management-system-php.html - Product

06 Sep 2024, 15:15

Type Values Removed Values Added
Summary (en) A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.' NOTE: The vendor states that the RTSP library is used for DEMO only, using it in product is a customer's behavior. Ambarella has emphasized that RTSP is DEMO only library, should NOT be used in product in our document. Because Ambarella's SDK is proprietary, we didn't publish our SDK source code in public network. (en) A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'
References
  • {'url': 'https://github.com/Ambarella-Inc/amba-cve-info/tree/main/cve-2020-24918', 'source': 'cve@mitre.org'}

05 Sep 2024, 19:15

Type Values Removed Values Added
References
  • () https://github.com/Ambarella-Inc/amba-cve-info/tree/main/cve-2020-24918 -
Summary (en) A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.' (en) A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.' NOTE: The vendor states that the RTSP library is used for DEMO only, using it in product is a customer's behavior. Ambarella has emphasized that RTSP is DEMO only library, should NOT be used in product in our document. Because Ambarella's SDK is proprietary, we didn't publish our SDK source code in public network.

Information

Published : 2020-09-09 15:15

Updated : 2024-11-21 05:14


NVD link : CVE-2020-24198

Mitre link : CVE-2020-24198

CVE.ORG link : CVE-2020-24198


JSON object : View

Products Affected

stock_management_system_project

  • stock_management_system
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')