CVE-2020-23647

6.1 mediumEPSS 0.5%

Medium (6.1) in boxbilling boxbilling. EPSS 0.5% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-04-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

boxbilling:boxbilling

References

https://github.com/boxbilling/boxbilling/issues/596
https://github.com/boxbilling/boxbilling/issues/596

Check your stack JSON