CVE-2023-38910
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
CSZ CMS version 1.3.0 is vulnerable to cross-site scripting (XSS), allowing attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section.
Risk Assessment
Exploitation of this vulnerability could lead to user data theft or session hijacking, posing a serious threat to the application's security and its users.
Recommendation
It is recommended to update CSZ CMS to the latest version and implement input validation in the 'Carousel Wiget' section to minimize XSS risk.
Other vulnerabilities in CSZ CMS 1.3.0
See all- CVE-2026-72601High
A vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including PII via the admin form-submission viewer. The endpoint lacks authentication and the auth helper fails open.
- CVE-2023-38911Medium
A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.
Original NVD description (English source)
CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS