CVE-2020-35395

XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScript code via the 'description' field

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.85% chance of exploitation in the next 30 days, 56th percentile

Published

2020-12-15

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://nikhilkumar01.medium.com/cve-2020-35395-cd393ac8371c
• https://www.exploit-db.com/exploits/49146

References

• CVE Record
• NVD entry

Related

• CVE-2020-35391
• CVE-2020-35396
• CVE-2020-35388
• CVE-2020-35398
• CVE-2020-35378
• CVE-2020-35416