First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-28792

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
I Thirteen Web Solution	Continuous Image Carousel With Lightbox	<= 1.0.15

References

Timeline

Published: Apr 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-287937.8Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zsc CVE-2023-287946.5Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connect CVE-2023-287957.8Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects CVE-2023-287967.8Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affect CVE-2023-287977.3Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user ca CVE-2023-287989.8An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution.CVE-2023-287996.1A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would re CVE-2023-28807.5Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the CVE-2023-288006.1When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing adm CVE-2023-288019.8An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This is CVE-2023-288025.4An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by in CVE-2023-288036.5An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a

CVE-2023-28792: Medium severity, CVSS 6.1 | Vulnix