CVE-2023-31868

MediumCVSS 5.4/10Last modified Jul 9, 2026

Description

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is injected into those fields, this code will be saved by the application and executed by the web browser of the user viewing the web page. Several injection points have been identified on the application. The major one requires the user to be authenticated with a common account, he can then target an Administrator. All others endpoints need the malicious user to be authenticated as an Administrator. Therefore, the impact is diminished.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 22, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-31875.4A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issu CVE-2023-318717.8OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root CVE-2023-318737.8Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').CVE-2023-318748.8Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').CVE-2023-31886.5Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.CVE-2023-318895.5An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a d CVE-2023-31896.1A vulnerability, which was classified as problematic, was found in SourceCodester Online School Fees System 1.0. This affects an unknown par CVE-2023-318909.8An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() p CVE-2023-318937.5Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.CVE-2023-31904.6Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-319029.8RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).CVE-2023-319039.8GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.