CVE-2023-26100

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user's web browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261017.5In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traveCVE-2023-261028.2All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function CVE-2023-261037.5Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functiCVE-2023-261047.5All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes coCVE-2023-261057.5All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.CVE-2023-261067.5All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.CVE-2023-261077.8All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametriCVE-2023-261085.3Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerCVE-2023-261099.8All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to impropeCVE-2023-26119.8Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user CVE-2023-261109.8All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user inputCVE-2023-261117.5All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to
CVE-2023-26100: Medium severity, CVSS 6.1 | Vulnix