CVE-2023-2973

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesheet Syste 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_company. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230204.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Students Online Internship Timesheet Syste	1.0

References

https://github.com/ShallowDream888/VulnerabilityReport/blob/main/XSS.mdExploit
https://vuldb.com/?ctiid.230204Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.230204Third Party Advisory, VDB Entry
https://github.com/ShallowDream888/VulnerabilityReport/blob/main/XSS.mdExploit
https://vuldb.com/?ctiid.230204Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.230204Third Party Advisory, VDB Entry

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-297317.5SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can l CVE-2023-297329.8SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The a CVE-2023-297337.8The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data tha CVE-2023-297349.8An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the dat CVE-2023-297355.5An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.CVE-2023-297369.8Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary f CVE-2023-297375.5An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database fi CVE-2023-297387.8An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privil CVE-2023-297399.8An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by ma CVE-2023-29748.1A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is CVE-2023-297407.5An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipul CVE-2023-297419.8An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the d