{"id":"GHSA-cv24-vh45-4hjm","aliases":["CVE-2020-28957"],"title":"Foxlor cross-site scripting (XSS) vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.","severity":"medium","score":5.4,"published":"2022-05-24T19:18:34.000Z","modified":"2024-04-25T21:43:28.006Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"froxlor/froxlor","sources":[{"name":"OSV · GHSA-cv24-vh45-4hjm","url":"https://osv.dev/vulnerability/GHSA-cv24-vh45-4hjm"}],"ranges":[],"versions":["0.10.16"],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-28957","https://github.com/Froxlor/Froxlor","https://www.vulnerability-lab.com/get_content.php?id=2241"],"sources":[{"name":"OSV","id":"GHSA-cv24-vh45-4hjm","modified":"2024-04-25T21:43:28.006927Z","url":"https://osv.dev/vulnerability/GHSA-cv24-vh45-4hjm"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T18:20:33.032Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}