CVE-2020-37022

Name of the Vulnerable Software and Affected Versions OpenZ ERP version 3.6.60

Description The software contains a persistent cross-site scripting issue within the Employee module. Specifically, the name and description parameters are susceptible to malicious script injection through POST requests. Successful exploitation could allow attackers to hijack sessions and manipulate application modules.

Recommendations Apply updates to address the issue in the Employee module's name and description parameters. As a temporary workaround, sanitize all input to the name and description parameters within the Employee module.