CVE-2023-33732

MediumCVSS 6.1

Published: 31/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.84%

53th percentile - higher than 53% of all known CVEs

Summary

The New Policy form in the Microworld Technologies eScan management console has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.

Risk Assessment

An attacker could exploit this vulnerability to perform XSS attacks, potentially leading to user data theft or session hijacking. Organizations should be aware of the security risks associated with the application.

Recommendation

It is recommended to update the eScan management console to the latest version to eliminate this vulnerability. Additionally, implementing extra security measures such as input validation is advisable.

Original NVD description (English source)

Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.