CVE-2023-37785

MediumCVSS 4.8

Published: 13/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

31th percentile - higher than 31% of all known CVEs

Summary

In ImpressCMS versions v1.4.5 and earlier, there is a cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the /editprofile.php component.

Risk Assessment

This vulnerability could lead to session hijacking or data theft, posing a significant security risk to the organization.

Recommendation

It is recommended to update ImpressCMS to the latest version to mitigate this vulnerability and conduct a security audit of the application.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.