CVE-2023-36337

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/nguyenkhanhthuan/f345c8ea0551c10ead197680f2ba9c66Exploit, Third Party Advisory
https://github.com/ThuanNguyen115685/Report/blob/main/XSS.mdBroken Link

Timeline

Published: Dec 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-363385.3Inventory Management System 1 was discovered to contain a SQL injection vulnerability.CVE-2023-363397.5An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.CVE-2023-36348.8In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mod CVE-2023-363409.8TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.CVE-2023-363447.8An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting th CVE-2023-363458.8A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.CVE-2023-363466.1POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.CVE-2023-363477.5A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.CVE-2023-363488.8POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.CVE-2023-36357.5GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the CVE-2023-363517.8An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.ba CVE-2023-363547.5TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 were discovered to contain a buffer overflow