CVE-2023-33780
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of news article.
Risk Assessment
Attackers can exploit this vulnerability to steal user data or hijack sessions, posing a serious threat to the application's security and its users.
Recommendation
It is recommended to update to the latest version of smartCARS to mitigate this vulnerability and implement additional security measures against XSS attacks.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of news article.