CVE-2023-0109

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-01105.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01115.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01125.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01137.5A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unk CVE-2023-01145.5A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of CVE-2023-01167.5The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect avai CVE-2023-01175.3The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this CVE-2023-01189.1An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary CVE-2023-01195.4A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input CVE-2023-01204.3An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.CVE-2023-01217.5A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting f CVE-2023-01227.5A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-