CVE-2023-37122

MediumCVSS 5.4

Published: 06/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

Bagecms v3.1.0 has a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.

Risk Assessment

Attackers can exploit this vulnerability to hijack user sessions or steal data, posing a significant security risk to the application and its users.

Recommendation

It is recommended to update Bagecms to the latest version to mitigate this vulnerability and to review and filter input data in application modules.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.