CVE-2023-39543

MediumCVSS 6.1

Published: 21/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

40th percentile - higher than 40% of all known CVEs

Summary

A cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user using the product.

Risk Assessment

This vulnerability could lead to user data theft or session hijacking, posing a significant security risk to the organization.

Recommendation

It is recommended to update LuxCal Web Calendar to version 5.2.3M or 5.2.3L to mitigate this vulnerability.

Original NVD description (English source)

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.