CVE-2023-3445

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
spinacms	spinacms/spina	>= unspecified, < 2.15.1
denkgroot	spina	< 2.15.1

References

https://github.com/spinacms/spina/commit/9adfe7b4807b3cc10dbb7351a26cc32f5d8c14a3Patch
https://huntr.dev/bounties/18a74a9d-4a2d-4bf8-ae62-56a909427070Exploit, Third Party Advisory
https://github.com/spinacms/spina/commit/9adfe7b4807b3cc10dbb7351a26cc32f5d8c14a3Patch
https://huntr.dev/bounties/18a74a9d-4a2d-4bf8-ae62-56a909427070Exploit, Third Party Advisory

Timeline

Published: Jun 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344505.3CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An interna CVE-2023-344518.2CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. The mempoo CVE-2023-344526.1Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scr CVE-2023-344537.5snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to CVE-2023-344547.5snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to CVE-2023-344557.5snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in v CVE-2023-344577.5MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicio CVE-2023-344585.3mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, i CVE-2023-344595.9OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the `verifyMu CVE-2023-34465.3Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_che CVE-2023-344609.8Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope CVE-2023-344615.4PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulnerability could have b