Lucene search
HistoryAug 18, 2023 - 7:15 p.m.
CVE-2023-38910
csz cms
xss
cross-site scripting
carousel widget
photo url
youtube url
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
30.7%
CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the ‘Carousel Wiget’ section and choosing our carousel widget created above, in ‘Photo URL’ and ‘YouTube URL’ plugin.
Affected configurations
Node
cszcmscsz_cmsMatch1.3.0
Related
cvelist
cvelist
CVE-2023-38910
2023-08-18 00:00:00
exploitdb
exploitdb
prion
prion
Cross site scripting
2023-08-18 19:15:00
zdt
zdt
cve
cve
CVE-2023-38910
2023-08-18 19:15:13
packetstorm
packetstorm
CSZ CMS 1.3.0 Cross Site Scripting
2023-09-04 00:00:00
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
30.7%
Related for NVD:CVE-2023-38910