CVE-2023-37636

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-37644.3The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9 CVE-2023-376445.5SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf. Thi CVE-2023-376455.3eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.CVE-2023-376467.8An issue in the CAB file extraction function of Bitberry File Opener v23.0 allows attackers to execute a directory traversal.CVE-2023-376479.8SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.CVE-2023-376497.5Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.CVE-2023-376510.0Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.CVE-2023-376508.8A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.CVE-2023-376569.8WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.CVE-2023-376575.4TwoNav v2.0.28-20230624 is vulnerable to Cross Site Scripting (XSS).CVE-2023-376585.4fast-poster v2.15.0 is vulnerable to Cross Site Scripting (XSS). File upload check binary of img, but without strictly check file suffix at CVE-2023-376599.8xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).