An issue was discovered in KMCIS CaseAware.

Published 9 y ago 2017-05-01 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

4.5%

percentile 92%

Public exploits

Exploit-DB · Nuclei check

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string.

Exploit prediction (EPSS)

4.49% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

Exploits and detections

Nuclei template KMCIS CaseAware - Cross-Site Scripting · nuclei detection template
EDB-42042 KMCIS CaseAware - Cross-Site Scripting · webapps · 2017-05-20

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

openbugbounty.org /incidents/228262/ · x_refsource_MISC, x_transferred
exploit-db.com /exploits/42042/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2017-5631
NVD: CVE-2017-5631

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.