CVE-2023-3143

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function of the file admin\posts\manage_post.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231012.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Online Discussion Forum Site	1.0

References

https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#11xss-vulnerability-in-adminpostsmanage_postphpcontentExploit
https://vuldb.com/?ctiid.231012Permissions Required, VDB Entry
https://vuldb.com/?id.231012Third Party Advisory, VDB Entry
https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#11xss-vulnerability-in-adminpostsmanage_postphpcontentExploit
https://vuldb.com/?ctiid.231012Permissions Required, VDB Entry
https://vuldb.com/?id.231012Third Party Advisory, VDB Entry

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-314305.5A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an CVE-2023-314315.5A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authent CVE-2023-314327.8Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged us CVE-2023-314338.8A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQL CVE-2023-314345.4The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Bui CVE-2023-314358.1Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys b CVE-2023-314367.8qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX CVE-2023-314375.3An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log m CVE-2023-314385.3An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integr CVE-2023-314395.3An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file suc CVE-2023-31445.4A vulnerability classified as problematic was found in SourceCodester Online Discussion Forum Site 1.0. Affected by this vulnerability is an CVE-2023-314415.5In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a crafted JSON file to sanit