CVE-2023-39714

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/Arajawat007/141e68161014e832e30d39b1979a8a6c#file-cve-2023-39714Exploit, Third Party Advisory
https://www.sourcecodester.com/Not Applicable
https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.htmlProduct
https://gist.github.com/Arajawat007/141e68161014e832e30d39b1979a8a6c#file-cve-2023-39714Exploit, Third Party Advisory
https://www.sourcecodester.com/Not Applicable
https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.htmlProduct

Timeline

Published: Sep 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-39727.8A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary CVE-2023-397269.8An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.CVE-2023-39736.1Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.CVE-2023-397315.3The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast me CVE-2023-397328.2The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broa CVE-2023-397338.2The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast m CVE-2023-397348.2The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token an CVE-2023-397358.2The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broad CVE-2023-397368.2The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted br CVE-2023-397378.2The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messa CVE-2023-397398.2The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted br CVE-2023-39749.8OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.