CVE-2023-48940

MediumCVSS 5.4

Published: 06/12/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability was discovered in DaiCuo version 2.5.15 in the /admin.php file. Attackers can inject malicious JavaScript or HTML via crafted input.

Risk Assessment

The risk involves arbitrary script execution in the administrator's browser, potentially leading to session theft, admin panel takeover, or sensitive data leakage.

Recommendation

Immediately update DaiCuo to the latest available version and implement input filtering and encoding in the /admin.php file.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.