CVE-2020-23647

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-236487.5Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can changeCVE-2020-236539.8An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wCVE-2020-236545.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."CVE-2020-236555.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."CVE-2020-236565.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."CVE-2020-236575.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."CVE-2020-236585.4PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.CVE-2020-236595.4WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.CVE-2020-236605.4webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."CVE-2020-236799.8Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password fieldCVE-2020-236807.8An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possibCVE-2020-236859.8SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the usernam