CVE-2023-27666

MediumCVSS 6.1

Published: 14/04/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

Auto Dealer Management System v1.0 contains a cross-site scripting (XSS) vulnerability via the name parameter in /classes/SystemSettings.php?f=update_settings. An attacker can inject malicious JavaScript code that will be executed in the victim's browser.

Risk Assessment

The risk includes potential session hijacking, credential theft, or unauthorized actions performed in the context of an authenticated administrator. This could lead to confidentiality and integrity breaches of system data.

Recommendation

Immediately update the system to the latest version or apply a security patch. If no update is available, implement input validation and output encoding for the name parameter.

Original NVD description (English source)

Auto Dealer Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the name parameter at /classes/SystemSettings.php?f=update_settings.