CVE-2023-0810

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
btcpayserver	btcpayserver/btcpayserver	>= unspecified, < 1.7.11

References

https://github.com/btcpayserver/btcpayserver/commit/dffa6accb04df7b80bc584dedef22c9297292ce6Patch
https://huntr.dev/bounties/a48414ea-63d9-453c-b3f3-2c927b71ec68Exploit, Issue Tracking, Third Party Advisory
https://github.com/btcpayserver/btcpayserver/commit/dffa6accb04df7b80bc584dedef22c9297292ce6Patch
https://huntr.dev/bounties/a48414ea-63d9-453c-b3f3-2c927b71ec68Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Feb 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08119.1Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a P CVE-2023-08127.5The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for som CVE-2023-08137.5A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, CVE-2023-08146.5The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the CVE-2023-08156.5Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosur CVE-2023-08166.5The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leadi CVE-2023-08177.8Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-08185.5Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-08197.8Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-08208.8The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to CVE-2023-08216.5HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause exce CVE-2023-08228.8The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to b