{"api_version":"1","generated_at":"2026-07-23T14:06:37+00:00","cve":"CVE-2020-25444","urls":{"html":"https://cve.report/CVE-2020-25444","api":"https://cve.report/api/cve/CVE-2020-25444.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-25444","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-25444"},"summary":{"title":"CVE-2020-25444","description":"Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) \"About Yourself” section under the “My Profile” page, \" (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name” fields under the “Manage Tour” page, and (4) all the labels under the “Menu” section.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-07-14 15:15:00","updated_at":"2023-11-07 03:20:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e","name":"https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e","refsource":"","tags":[],"title":"Vulnerabilities in Booking Core 1.7 | by Satyam Singh | Jul, 2021 | Medium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://medium.com/@singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e","name":"https://medium.com/@singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e","refsource":"MISC","tags":[],"title":"Vulnerabilities in Booking Core 1.7 | by Satyam Singh | Jul, 2021 | Medium","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25444","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25444","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"25444","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bookingcore","cpe5":"booking_core","cpe6":"1.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"25444","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"booking_core_project","cpe5":"booking_core","cpe6":"1.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2020-25444","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) \"About Yourself” section under the “My Profile” page, \" (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name” fields under the “Manage Tour” page, and (4) all the labels under the “Menu” section."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://medium.com/@singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e","url":"https://medium.com/@singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e"}]}},"nvd":{"publishedDate":"2021-07-14 15:15:00","lastModifiedDate":"2023-11-07 03:20:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:bookingcore:booking_core:1.7.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"25444","Ordinal":"186860","Title":"CVE-2020-25444","CVE":"CVE-2020-25444","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"25444","Ordinal":"1","NoteData":"Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) \"About Yourself” section under the “My Profile” page, \" (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name” fields under the “Manage Tour” page, and (4) all the labels under the “Menu” section.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"25444","Ordinal":"2","NoteData":"2021-07-14","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"25444","Ordinal":"3","NoteData":"2021-07-14","Type":"Other","Title":"Modified"}]}}}