CVE-2020-35706: XSS
Published Dec 25, 2020
·Updated
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
Affected Software
1 affected component
Daybydaycrm Daybyday=2.1.0
Event History
Dec 25, 2020
CVE Published
via MITRE·05:24 AM
Data Sourced
via MITRE·05:24 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-35706?
CVE-2020-35706 has a moderate severity level due to its potential for stored XSS attacks.
2
How do I fix CVE-2020-35706?
To fix CVE-2020-35706, update your Daybyday CRM installation to version 2.1.1 or later, which addresses the vulnerability.
3
What systems are affected by CVE-2020-35706?
CVE-2020-35706 affects Daybyday CRM version 2.1.0 when handling the Title parameter in the New Project screen.
4
Can CVE-2020-35706 be exploited remotely?
Yes, CVE-2020-35706 can be exploited remotely, allowing attackers to execute scripts in the context of the user's browser.
5
What types of attacks are possible with CVE-2020-35706?
CVE-2020-35706 allows for stored cross-site scripting (XSS) attacks, which can lead to session hijacking or data theft.