CVE-2023-39518
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The social-media-skeleton project, implemented using PHP, MySQL, CSS, JavaScript, and HTML, has a stored XSS vulnerability in versions 1.0.0 to 1.0.3. The issue is patched in version 1.0.3.
Risk Assessment
Exploitation of this vulnerability could lead to user data theft or account takeover. Organizations should be aware of the risks associated with outdated software versions.
Recommendation
It is recommended to upgrade to version 1.0.3 or later to eliminate this vulnerability. Regularly reviewing and updating software is crucial for security.
Other vulnerabilities in social-media-skeleton
See all- CVE-2023-39344Critical
The social-media-skeleton project has a SQL injection vulnerability that allows UNION based injections, which indirectly leads to remote code execution. A fix has been introduced in commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1.
- CVE-2023-40174Medium
CVE-2023-40174 affects the Social media skeleton project, which improperly manages the user session lifecycle. Versions prior to 1.0.5 did not adequately limit session duration, posing a risk of unauthorized access.
- CVE-2023-40173High
Social Media Skeleton prior to version 1.0.5 did not properly salt passwords, making them susceptible to cracking if an attacker gained access to hashed passwords.
- CVE-2023-40172Medium
CVE-2023-40172 affects the Social media skeleton project, which prior to version 1.0.5 did not properly restrict Cross-site request forgery (CSRF) attacks. An attacker could trick a victim into performing unintended actions on a website.
Original NVD description (English source)
social-media-skeleton is an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Versions 1.0.0 until 1.0.3 have a stored cross-site scripting vulnerability. The problem is patched in v1.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS