CVE-2023-33736
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Dcat-Admin v2.1.3-beta has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
Risk Assessment
This vulnerability could lead to user data theft or session hijacking, posing a significant security risk to the application and its users.
Recommendation
It is recommended to update Dcat-Admin to the latest version that addresses this vulnerability and to implement input validation and filtering.
Other vulnerabilities in Dcat-Admin v2.1.3-beta
See all- CVE-2026-11621Medium
Dcat-Admin up to version 2.2.3-beta has a vulnerability in the editorMDUpload function on the user settings page. Manipulation of the editormd-image-file argument leads to unrestricted file upload. The attack can be remote.
- CVE-2024-29644Medium
A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS