VulnerabilityModified

CVE-2021-37330

Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting (XSS).

MEDIUM 5.4EPSS 0.57%

Does this matter?

Lower severity and a low EPSS score (0.57%). Track it; it rarely justifies an emergency change on its own.

Description

Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting (XSS). The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigger.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.57% probability · 45th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: bookingcore/booking core
Source: cve@mitre.org

References

https://www.navidkagalwalla.com/booking-core-vulnerabilitiesExploit, Third Party Advisory
https://www.navidkagalwalla.com/booking-core-vulnerabilitiesExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.