CVE-2023-38397

23th percentile - higher than 23% of all known CVEs

The Eggemplo Gestion-Pymes plugin versions <= 1.5.6 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the victim's browser context.

This vulnerability could lead to user data theft, session hijacking, and other serious security breaches within the organization. Specifically, an attacker with admin account access could gain full control over the application.

It is recommended to update the Eggemplo Gestion-Pymes plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application and monitoring logs for potential attacks is advisable.