CVE-2023-3542
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was found in ThinuTech ThinuCMS version 1.5 that allows cross site scripting (XSS) attacks through manipulation of arguments in the /contact.php file.
Risk Assessment
An attacker can remotely exploit this vulnerability, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update ThinuCMS to the latest version and to validate and sanitize input data in the /contact.php file.
Other vulnerabilities in ThinuTech ThinuCMS 1.5
See all- CVE-2023-3541Low
A vulnerability has been found in ThinuTech ThinuCMS version 1.5 that allows cross-site scripting (XSS) attacks through manipulation of the 'author' argument in the /author_posts.php file. Injecting malicious scripts can lead to unauthorized code execution in users' browsers.
- CVE-2023-3528Medium
A critical vulnerability was found in ThinuTech ThinuCMS version 1.5. Manipulation of the cat_id argument in the /category.php file leads to SQL injection, which can be exploited remotely.
Original NVD description (English source)
A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launched remotely. VDB-233294 is the identifier assigned to this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS