A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in…
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login.
Why it matters now
EPSS 0.02109 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Car Rental Management System Project |
- cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Car Rental Management System Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-23832
- 2026-10-03 Alias added: GHSA-hhfh-44xw-558f
References
More Car Rental Management System Project Car Rental Management System vulnerabilities
- TI-2020-17603 An issue was discovered in Car Rental Management System 1.0. CVSS 3.1CRITICAL 9.8
- TI-2020-17008 An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental… CVSS 3.1CRITICAL 9.8
- TI-2022-13802 Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via… CVSS 3.1CRITICAL 9.8
- TI-2020-17630 An SQL injection vulnerability was discovered in Car Rental Management System v1.0 can be… CVSS 3.1CRITICAL 9.8
- TI-2022-13803 Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via… CVSS 3.1CRITICAL 9.8
- TI-2022-13810 Car Rental Management System v1.0 is vulnerable to SQL Injection via… CVSS 3.1HIGH 7.2
Sources
- CVE-2020-23832 · CVE Program
- CVE-2020-23832 · NVD
- FIRST EPSS
- GHSA-hhfh-44xw-558f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences