CVE-2023-21516

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-215179.8Heap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.CVE-2023-215187.8Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary CVE-2023-21529.8A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by thi CVE-2023-215205.3A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 could allow an attacker CVE-2023-215217.2An SQL Injection vulnerability in the Management Console  (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to CVE-2023-215226.1A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an att CVE-2023-215235.4A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 co CVE-2023-215247.8Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability CVE-2023-215255.3Remote Procedure Call Runtime Denial of Service Vulnerability CVE-2023-215267.4Windows Netlogon Information Disclosure Vulnerability CVE-2023-215277.5Windows iSCSI Service Denial of Service Vulnerability CVE-2023-215287.8Microsoft SQL Server Remote Code Execution Vulnerability