CVE-2023-25810

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-258115.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. UCVE-2023-258128.8Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minioCVE-2023-258139.8Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are paCVE-2023-258146.5metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file thCVE-2023-258152.2In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to CVE-2023-258166.5Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource ConsumpCVE-2023-258178.1Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their perCVE-2023-258187.1Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of CVE-2023-258195.3Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any siteCVE-2023-25826.1A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatioCVE-2023-258207.8Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enteCVE-2023-258217.5Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, conta
CVE-2023-25810: Medium severity, CVSS 5.4 | Vulnix