CVE-2023-38911

MediumCVSS 5.4

Published: 18/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile - higher than 37% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.

Risk Assessment

This vulnerability could lead to account takeover or data theft, posing a significant security risk to the organization.

Recommendation

It is recommended to update CSZ CMS to the latest version to mitigate this vulnerability and to monitor the application for unauthorized activities.

Original NVD description (English source)

A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.