CVE-2023-37786
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settings[backend], Mail Settings[host], Mail Settings[port], and Mail Settings[auth] parameters of the /admin/configuration.php.
Risk Assessment
These vulnerabilities could lead to session hijacking and data theft, posing a significant security risk to the application and its users.
Recommendation
It is recommended to update Geeklog to the latest version to eliminate these vulnerabilities and to review and filter input data to prevent XSS injections.
Original NVD description (English source)
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settings[backend], Mail Settings[host], Mail Settings[port] and Mail Settings[auth] parameters of the /admin/configuration.php.