CVE-2023-33408

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validation in the application's user input handling in the security_helper.php file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Thirukrishnan/CVE-2023-33408Exploit, Third Party Advisory
https://github.com/minical/minicalProduct
https://github.com/Thirukrishnan/CVE-2023-33408Exploit, Third Party Advisory
https://github.com/minical/minicalProduct

Timeline

Published: Jun 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-334096.5Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.CVE-2023-33417.5The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth CVE-2023-334108.8Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d CVE-2023-334117.5A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 CVE-2023-334128.8The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro CVE-2023-334138.8The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation CVE-2023-33429.9The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type v CVE-2023-33438.8The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization CVE-2023-334385.4A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web scri CVE-2023-334397.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.CVE-2023-33444.8The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could a CVE-2023-334407.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.