CVE-2020-35753

Published: Jan 26, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The job posting recommendation form in Persis Human Resource Management Portal (Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20), when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter.

Affected (2)

Products: Persis: Human Resource Management Portal

Persis

1 product

Human Resource Management Portal

Configuration A

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Persis Human Resource Management Portal	From 17.2.00 to 17.2.35
Persis Human Resource Management Portal	From 19.0.00 to 19.0.20

Running on/with	Platform Versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Persis-Online-Bewerberportal

Source: cve@mitre.org

ExploitThird Party Advisory

https://slashcrypto.org/2021/02/20/CVE-2020-35753/

Source: cve@mitre.org

ExploitThird Party Advisory

https://it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Persis-Online-Bewerberportal

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://slashcrypto.org/2021/02/20/CVE-2020-35753/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.