CVE-2023-36306
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.
Risk Assessment
This vulnerability may lead to the compromise of the application and the theft of user data, posing a serious security threat to the organization.
Recommendation
It is recommended to update Adiscon Aiscon LogAnalyzer to the latest version to eliminate this vulnerability and implement additional security measures against XSS attacks.
Original NVD description (English source)
A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.