CVE-2023-3189

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in SourceCodester Online School Fees System 1.0. This affects an unknown part of the file /paysystem/branch.php of the component POST Parameter Handler. The manipulation of the argument branch leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231501 was assigned to this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Online School Fees System	1.0

References

https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.231501Permissions Required, Third Party Advisory
https://vuldb.com/?id.231501Third Party Advisory
https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.231501Permissions Required, Third Party Advisory
https://vuldb.com/?id.231501Third Party Advisory

Timeline

Published: Jun 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-318909.8An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() p CVE-2023-318937.5Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.CVE-2023-31904.6Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-319029.8RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).CVE-2023-319039.8GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.CVE-2023-319047.5savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion.CVE-2023-319067.8Jerryscript 3.0.0(commit 1a2c047) was discovered to contain a heap-buffer-overflow via the component lexer_compare_identifier_to_chars at /j CVE-2023-319077.8Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via the component scanner_literal_is_created at /jerry-core/parser/js/js-CVE-2023-319087.8Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component ecma_builtin_typedarray_prototype_sort.CVE-2023-31915.4Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-319107.8Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component parser_parse_function_statement at /jerr CVE-2023-319135.5Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/js