CVE-2023-36816

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Bubka	2FAuth	< 4.0.3

References

https://github.com/Bubka/2FAuth/releases/tag/v4.0.3Release Notes
https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9qExploit, Vendor Advisory
https://github.com/Bubka/2FAuth/releases/tag/v4.0.3Release Notes
https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9qExploit, Vendor Advisory

Timeline

Published: Jul 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-368179.1`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public c CVE-2023-368187.5Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denia CVE-2023-368196.5Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/k CVE-2023-36829.8A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0. Affected is an unknown function of CVE-2023-368206.5Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6,CVE-2023-368218.8Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.CVE-2023-368228.1Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated CVE-2023-368236.1Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CS CVE-2023-368248.8Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of argume CVE-2023-368259.8Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerabil CVE-2023-368266.5Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated us CVE-2023-368277.5Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the