Stored Cross-Site Scripting Vulnerability in eyoucms by Weng Xianhu
CVE-2023-37136

5.4MEDIUM

Key Information:

Vendor

Eyoucms

Status
Eyoucms
Vendor
CVE Published:
6 July 2023

What is CVE-2023-37136?

A stored cross-site scripting vulnerability exists in the Basic Website Information module of eyoucms version 1.6.3. This vulnerability enables attackers to inject and execute arbitrary web scripts or HTML by leveraging a specially crafted payload. If exploited, this can lead to unauthorized actions, data theft, or defacement of web applications, emphasizing the critical need for timely patching and rigorous input validation.

References

https://github.com/weng-xianhu/eyoucms/issues/49

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.