CVE-2023-0287

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-218294 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ityouknow	favorites-web	n/a

References

https://gitee.com/ityouknow/favorites-web/issues/I684L9Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.218294Third Party Advisory
https://vuldb.com/?id.218294Third Party Advisory
https://gitee.com/ityouknow/favorites-web/issues/I684L9Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.218294Third Party Advisory
https://vuldb.com/?id.218294Third Party Advisory

Timeline

Published: Jan 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-02887.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.CVE-2023-02895.4Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.CVE-2023-02904.3Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where t CVE-2023-02919.1The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated CVE-2023-02928.1The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is CVE-2023-02934.3The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its A CVE-2023-02944.3The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.CVE-2023-02954.8The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, an CVE-2023-02965.3The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy comp CVE-2023-02979.8Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.CVE-2023-02986.5Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.CVE-2023-02999.8Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.