CVE-2023-1772

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in DataGear up to 4.5.1. It has been classified as problematic. This affects an unknown part of the component Diagram Type Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224673 was assigned to this vulnerability.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	DataGear	4.5.0; 4.5.1

References

https://github.com/yangyanglo/ForCVE/blob/main/2023-0x02.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.224673Third Party Advisory
https://vuldb.com/?id.224673Third Party Advisory
https://github.com/yangyanglo/ForCVE/blob/main/2023-0x02.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.224673Third Party Advisory
https://vuldb.com/?id.224673Third Party Advisory

Timeline

Published: Mar 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-17739.8A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConf CVE-2023-17745.4When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allow CVE-2023-17756.5When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast t CVE-2023-17765.4Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to CVE-2023-17775.3Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosin CVE-2023-17789.8This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default creden CVE-2023-17794.3Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX2 CVE-2023-17806.1The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pa CVE-2023-17829.8HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for cluste CVE-2023-17837.6OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application CVE-2023-17849.8A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Do CVE-2023-17859.8A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as critical. Affected is an unknown