CVE-2023-38971
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Badaso versions 0.0.1 through 2.9.7 have a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
Risk Assessment
This vulnerability could lead to an attacker gaining control over the application, posing a serious threat to user data security.
Recommendation
It is recommended to update Badaso to the latest version to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in Badaso
See all- CVE-2023-38970Medium
Badaso versions from 0.0.1 to 2.9.7 contain a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload in the 'Name of member' parameter in the add new member function.
- CVE-2023-38974Medium
In version 2.9.7 of Badaso, there is a stored XSS vulnerability in the Edit Category function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
- CVE-2023-38973Medium
In version 2.9.7 of Badaso, there is a stored XSS vulnerability in the Add Tag function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
Original NVD description (English source)
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS