CVE-2023-23326

MediumCVSS 5.4/10Last modified Jul 9, 2026

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-233274.9An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stor CVE-2023-233288.8A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploadi CVE-2023-23336.1The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does no CVE-2023-233307.5amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.CVE-2023-233319.8Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.CVE-2023-233339.8There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restricti CVE-2023-23345.4The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 CVE-2023-233427.1If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.CVE-2023-233436.1A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque la CVE-2023-233446.5A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.CVE-2023-233467.1HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality a CVE-2023-233477.1HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality