CVE-2020-25761

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.82% chance of exploitation in the next 30 days, 77th percentile

Published

2020-09-29

Updated

2025-11-11

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0-Cross-Si…
• http://seclists.org/fulldisclosure/2020/Sep/45
• https://packetstormsecurity.com/files/author/15149/
• https://www.exploit-db.com/exploits/48830

References

• CVE Record
• NVD entry

Related

• CVE-2020-25760
• CVE-2020-25762
• CVE-2020-25755
• CVE-2020-25763
• CVE-2020-25754
• CVE-2020-25780