CVE-2023-0738

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-07396.8Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1CVE-2023-07409.0Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07419.0Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07429.0Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07439.0Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07449.8Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-07459.8The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using CVE-2023-07466.1The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforCVE-2023-07475.4Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.CVE-2023-07486.1Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.CVE-2023-07496.5The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowinCVE-2023-07509.8Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface.  When the device can be accessed over the netw
CVE-2023-0738: Medium severity, CVSS 6.1 | Vulnix