Login Request a demo
Medium severity · published Sep 30, 2020
CVE-2020-25761
Projectworlds Visitor Management System in PHP 1.0 allows XSS
6.1
CVSS
1.8%
EPSS
No
On KEV
Description
Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VM
Visitor Management System · Projectworlds
1.0 · source: NVD
Affected product
VM
Visitor Management System
Projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25761
Exploit
http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0-Cross-Site-Scripting.html
Exploit
http://seclists.org/fulldisclosure/2020/Sep/45
Exploit
https://packetstormsecurity.com/files/author/15149/
www.exploit-db.com
https://www.exploit-db.com/exploits/48830
More from Visitor Management System
9.8
CVE-2025-9047
projectworlds Visitor Management System visitor_out.php sql injection
9.8
CVE-2025-8948
projectworlds Visitor Management System front.php sql injection
9.8
CVE-2025-8947
projectworlds Visitor Management System query_data.php sql injection
9.8
CVE-2024-22922
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php
8.8
CVE-2020-25760
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection