CVE-2023-38501

🗓️ 25 Jul 2023 21:06:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 96 Views🌐 WEB

copyparty v1.8.7 reflected XSS via URL paramete

Reporter	Title	Published	Views	Family All 18
0day.today	copyparty v1.8.6 - Reflected Cross Site Scripting Vulnerability	28 Jul 202300:00	–	zdt
Circl	CVE-2023-38501	23 Jul 202316:22	–	circl
CNNVD	Copyparty 跨站脚本漏洞	25 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-38501 copyparty vulnerable to reflected cross-site scripting via k304 parameter	25 Jul 202321:06	–	cvelist
Exploit DB	copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)	28 Jul 202300:00	–	exploitdb
Github Security Blog	copyparty vulnerable to reflected cross-site scripting via k304 parameter	25 Jul 202317:49	–	github
Nuclei	CopyParty v1.8.6 - Cross Site Scripting	6 Jun 202603:01	–	nuclei
NVD	CVE-2023-38501	25 Jul 202322:15	–	nvd
OSV	CVE-2023-38501 copyparty vulnerable to reflected cross-site scripting via k304 parameter	25 Jul 202321:06	–	osv
OSV	GHSA-F54Q-J679-P9HH copyparty vulnerable to reflected cross-site scripting via k304 parameter	25 Jul 202317:49	–	osv

NVD

Vulners

Vulnrichment

Node

9001 copypartyRange<1.8.7

[
  {
    "vendor": "9001",
    "product": "copyparty",
    "versions": [
      {
        "version": "< 1.8.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html
github	www.github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38
github	www.github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh

Parameter	Position	Path	Description	CWE
k304	query param	/?k304=...	Reflected XSS via URL parameters k304 and setck in copyparty < 1.8.7	CWE-79
setck	query param	/?k304=...	Reflected XSS via URL parameters k304 and setck in copyparty < 1.8.7	CWE-79

04 Sep 2025 13:04Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1 - 6.3

EPSS0.79633

SSVC

CWE-79