Total
47482 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-53900 | 1 Spip | 1 Spip | 2026-06-17 | N/A | 8.8 HIGH |
| Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administrators into clicking a crafted SVG logo that redirects to a potentially dangerous URL through improper file upload filtering. | |||||
| CVE-2023-53898 | 1 Rukovoditel | 1 Rukovoditel | 2026-06-17 | N/A | 5.4 MEDIUM |
| Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert iframe and script payloads in application copyright text to execute arbitrary JavaScript in victim browsers. | |||||
| CVE-2023-53897 | 1 Rukovoditel | 1 Rukovoditel | 2026-06-17 | N/A | 5.4 MEDIUM |
| Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert XSS payloads in project task comments to execute arbitrary JavaScript in victim browsers. | |||||
| CVE-2023-53891 | 1 Blackcat-cms | 1 Blackcat Cms | 2026-06-17 | N/A | 5.4 MEDIUM |
| Blackcat CMS 1.4 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into page content. Attackers can insert JavaScript payloads in the page modification interface that execute when other users view the compromised page. | |||||
| CVE-2023-53890 | 1 Grabaperch | 1 Perch | 2026-06-17 | N/A | 5.4 MEDIUM |
| Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags that execute when the file is viewed, potentially stealing user session information or performing client-side attacks. | |||||
| CVE-2023-53887 | 1 Zomp | 1 Zomplog | 2026-06-17 | N/A | 5.4 MEDIUM |
| Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new pages. Attackers can craft malicious image source and onerror attributes to execute arbitrary JavaScript code in victim's browser. | |||||
| CVE-2023-53884 | 1 Webedition | 1 Webedition Cms | 2026-06-17 | N/A | 5.4 MEDIUM |
| Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files through the media upload feature to inject and execute arbitrary scripts when the file is viewed by other users. | |||||
| CVE-2023-53882 | 2026-06-17 | N/A | N/A | ||
| JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts. Attackers can craft malicious links with XSS payloads to steal session tokens or execute arbitrary JavaScript in victims' browsers. | |||||
| CVE-2023-53880 | 2026-06-17 | N/A | N/A | ||
| Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions. | |||||
| CVE-2023-53870 | 2026-06-17 | N/A | N/A | ||
| Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information. | |||||
| CVE-2023-53738 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.4 MEDIUM |
| A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers during page preview interactions. | |||||
| CVE-2023-53737 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 4.8 MEDIUM |
| A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. Attackers can execute scripts that could affect multiple parts of the administration interface. | |||||
| CVE-2023-53736 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.4 MEDIUM |
| A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context. | |||||
| CVE-2023-53735 | 2026-06-17 | N/A | N/A | ||
| WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaScript code, enabling potential XSS attacks. | |||||
| CVE-2023-53690 | 1 Nagios | 1 Fusion | 2026-06-17 | N/A | 4.8 MEDIUM |
| Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add authentication servers via LDAP/AD integration could persist a malicious payload that executes in the context of other users' browsers. | |||||
| CVE-2023-53689 | 1 Nagios | 1 Fusion | 2026-06-17 | N/A | 4.8 MEDIUM |
| Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly corrupted by the reflected XSS, the resulting browser compromise can lead to credential/session theft and unauthorized administrative actions. | |||||
| CVE-2023-53688 | 1 Nagios | 1 Nagios Xi | 2026-06-17 | N/A | 5.4 MEDIUM |
| Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allowing injection of malicious script that executes in the context of a victim's browser (XSS). Additionally, the component does not enforce sufficient anti-CSRF protections on state-changing operations, enabling an attacker to induce authenticated users to perform unwanted actions. | |||||
| CVE-2023-53155 | 2026-06-17 | N/A | 7.2 HIGH | ||
| goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter. | |||||
| CVE-2023-52430 | 1 Authcrunch | 1 Caddy-security | 2026-06-17 | N/A | 6.1 MEDIUM |
| The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring. | |||||
| CVE-2023-52330 | 1 Trendmicro | 1 Apex One | 2026-06-17 | N/A | 6.1 MEDIUM |
| A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central. Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | |||||