Lucene search

PRIOn knowledge basePRION:CVE-2023-52265

HistoryDec 30, 2023 - 11:15 p.m.

Cross site scripting

2023-12-3023:15:00

PRIOn knowledge base

www.prio-n.com

cross site scripting

stored xss

idurar

erp

crm

patch request

crafted json

email template

api

data

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.

CPENameOperatorVersion
idurarle2.0.1

CPE	Name	Operator	Version
	idurar	le	2.0.1

References

github.com/idurar/idurar-erp-crm/compare/2.0.1...2.1.0

github.com/wbowm15/jubilant-enigma/blob/main/writeup.md