6.1 Medium

CVE-2022-42753 SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users

Description

SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks.

Affected products and versions

Product	Affected versions	Fixed in
SalonERP	3.0.2	No fix stated

Do you use SalonERP?

Track this CVE Watch SalonERP Check my SBOMs

www.cveye.io/en/cve/CVE-2022-42753

Timeline

Published November 3, 2022
Last modified May 5, 2025

References

salonerp.sourceforge.io salonerp.sourceforge.io
fluidattacks.com fluidattacks.com

Track this CVE