CVE-2023-38910

MediumCVSS 6.1

Published: 18/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

35th percentile - higher than 35% of all known CVEs

Summary

CSZ CMS version 1.3.0 is vulnerable to cross-site scripting (XSS), allowing attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section.

Risk Assessment

Exploitation of this vulnerability could lead to user data theft or session hijacking, posing a serious threat to the application's security and its users.

Recommendation

It is recommended to update CSZ CMS to the latest version and implement input validation in the 'Carousel Wiget' section to minimize XSS risk.

Original NVD description (English source)

CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin.