CVE-2023-41425

MediumCVSS 6.1

Published: 07/11/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

54.31%

99th percentile - higher than 99% of all known CVEs

Summary

A Cross-Site Scripting vulnerability in Wonder CMS versions 3.2.0 through 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.

Risk Assessment

An attacker can inject malicious scripts, leading to session hijacking, admin account takeover, or website defacement.

Recommendation

Immediately update Wonder CMS to the latest available version and restrict access to the admin panel to trusted IP addresses only.

Other vulnerabilities in Wonder CMS

See all

CVE-2014-8701High
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
CVE-2014-8705Critical
Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
CVE-2014-8704Critical
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.

Original NVD description (English source)

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.