CVE-2023-28650

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute the malicious JavaScript (JS) payload in the target’s security context.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-286514.8Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected produ CVE-2023-286526.5An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition.CVE-2023-286537.8The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-afte CVE-2023-286549.8Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web m CVE-2023-286555.4A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted pri CVE-2023-286568.1NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. CVE-2023-286578.8Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected prod CVE-2023-286587.8Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable CVE-2023-286598.8The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc CVE-2023-28667.8If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web sh CVE-2023-286608.8The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' pa CVE-2023-286618.8The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' paramete