CVE-2023-53985mediumCWE-79

Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.3%

probabilidade de exploração

0.3%top 79% das CVEs

exploração observada

nãonenhuma fonte reporta

Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input parameters. Attackers can submit crafted payloads in manual insertion points to execute arbitrary JavaScript code in victim's browser context.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Produtos afetados

Zippy · Zstore

Referências

https://github.com/leon-mbs/zstore https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.5.4 https://www.exploit-db.com/exploits/51207 https://www.vulncheck.com/advisories/zstore-reflected-cross-site-scripting-xss https://zippy.com.ua/