CVE-2023-31466

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance report" and "Configuration -> Timekeeper Configuration -> Add a new source there" screens, there are entry points to inject JavaScript code.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jul 26, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-314687.8An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder CVE-2023-314698.8A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admiCVE-2023-31478.8A vulnerability has been found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This vulnerability affects unkCVE-2023-314709.8SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain functionCVE-2023-314719.8An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary softCVE-2023-314727.5An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on CVE-2023-314734.9An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on CVE-2023-314747.5An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary paramCVE-2023-314759.8An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item iCVE-2023-314767.5An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be creCVE-2023-314777.5A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrarCVE-2023-314787.5An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SS
CVE-2023-31466: Medium severity, CVSS 5.4 | Vulnix