CVE-2023-28599

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-74

Affected software

Vendor	Product	Versions
Zoom Video Communications, Inc.	Zoom for Android	before 5.13.10
Zoom Video Communications, Inc.	Zoom for iOS	before 5.13.10
Zoom Video Communications, Inc.	Zoom for Linux	before 5.13.10
Zoom Video Communications, Inc.	Zoom for macOS	before 5.13.10
Zoom Video Communications, Inc.	Zoom for Windows	before 5.13.10

References

https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory

Timeline

Published: Jun 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-28604.4An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of se CVE-2023-286005.4Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom CVE-2023-286016.5Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. CVE-2023-286027.7Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may po CVE-2023-286037.1Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local CVE-2023-286046.1The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {con CVE-2023-286066.1js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.CVE-2023-286076.1js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.CVE-2023-286099.8api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.CVE-2023-28617.1A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on t CVE-2023-286109.8The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update ima CVE-2023-286119.8Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended a