CVE-2023-38911
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.
Risk Assessment
This vulnerability could lead to account takeover or data theft, posing a significant security risk to the organization.
Recommendation
It is recommended to update CSZ CMS to the latest version to mitigate this vulnerability and to monitor the application for unauthorized activities.
Other vulnerabilities in CSZ CMS 1.3.0
See all- CVE-2026-72601High
A vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including PII via the admin form-submission viewer. The endpoint lacks authentication and the auth helper fails open.
- CVE-2023-38910Medium
CSZ CMS version 1.3.0 is vulnerable to cross-site scripting (XSS), allowing attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section.
Original NVD description (English source)
A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS