LiveActive security incident?Get immediate response
CVE Record

CVE-2020-23974: Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat...

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE reports stored cross-site scripting and HTML injection in Create-Project Manager 1.07. A malicious entry in chat, social feed, message, or client fields could affect later users who view it. The public bundle does not provide CVSS, vendor confirmation, a patch version, or evidence of active exploitation.

Executive priority

Prioritize identification first. If the application is not deployed, business risk is negligible. If it is deployed and accepts input from many users or the internet, treat it as a meaningful web application risk until vendor guidance or replacement is confirmed.

Technical view

CVE-2020-23974 describes multiple persistent XSS and HTML injection flaws in Create-Project Manager 1.07. Reported affected areas include Online chat, Social feed, Message title-tag, and Add new client fields. Stored attacker-controlled markup or script could render for later users. CVSS, CWE, vendor, patch, and CPE data are not provided in the bundle.

Likely exposure

Exposure appears limited to organizations still running Create-Project Manager 1.07, especially deployments where untrusted or lower-privileged users can submit content to the affected fields. The bundle does not identify vendor CPEs, hosting model, authentication requirements, or affected versions beyond 1.07.

Exploitation context

The sources are public vulnerability disclosures, and the CVE is not marked as CISA KEV. The provided evidence supports public knowledge of the issue, but not confirmed in-the-wild exploitation. Persistent XSS can support session theft, malicious actions in a user's browser, or content tampering depending on application context.

Researcher notes

The record is sparse and relies on third-party public references. No CVSS, CWE, CPE, patch, or exploitation confirmation is present in the bundle. Validate product identity and deployment details before scoring. Avoid assuming affected versions beyond Create-Project Manager 1.07.

Mitigation direction

  • Check vendor or project guidance for an official fix or maintained replacement.
  • Inventory any Create-Project Manager 1.07 deployments, including internal instances.
  • Restrict access to affected workflows until remediation is confirmed.
  • Review input handling and output encoding for the named fields.
  • Monitor application logs for suspicious stored content submissions.

Validation and detection

  • Confirm whether Create-Project Manager 1.07 is deployed anywhere.
  • Identify who can write to chat, social feed, message, and client fields.
  • Review vendor advisories or repository history for a patched version.
  • Safely test in a non-production environment for stored rendering behavior.
  • Verify compensating controls block untrusted markup from rendering.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-23974 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.