CVE-2023-28148

HighCVSS 7.2/10Last modified Sep 22, 2026

Description

A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 14, 2026
Last modified
Sep 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2023

CVE-2023-281496.1An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 0CVE-2023-28159.8A vulnerability classified as critical was found in SourceCodester Online Jewelry Store 1.0. Affected by this vulnerability is an unknown fuCVE-2023-281509.8An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in CVE-2023-281519.8An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remoteCVE-2023-281529.8An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD inCVE-2023-281536.4An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restricCVE-2023-281549.8Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker whCVE-2023-281556.1The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protoCVE-2023-281585.4Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticaCVE-2023-281594.3The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion orCVE-2023-28166.5Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patcCVE-2023-281606.5When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking po
CVE-2023-28148: High severity, CVSS 7.2 | Vulnix