Vulnerability Details CVE-2019-1010287
Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.206
EPSS Ranking 95.3%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
Products affected by CVE-2019-1010287
-
cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:1.3.1
-
cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:1.4.1
-
cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:1.5.0
-
cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:1.5.2
-
cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:1.5.3