CVE-2023-38569

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SHIRASAGI Project	SHIRASAGI	prior to v1.18.0

References

https://jvn.jp/en/jp/JVN82758000/Third Party Advisory
https://www.ss-proj.org/support/954.htmlPatch, Vendor Advisory
https://jvn.jp/en/jp/JVN82758000/Third Party Advisory
https://www.ss-proj.org/support/954.htmlPatch, Vendor Advisory

Timeline

Published: Sep 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-38576.1A vulnerability, which was classified as problematic, was found in phpscriptpoint Ecommerce 1.15. This affects an unknown part of the file /CVE-2023-385707.8Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalatio CVE-2023-385717.5This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ven CVE-2023-385727.5The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macO CVE-2023-385738.8A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafted Javascript code in CVE-2023-385746.1Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web site CVE-2023-385755.5Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially CVE-2023-385768.0Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticated user to execute arb CVE-2023-385798.8The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, CVE-2023-38586.1A vulnerability has been found in phpscriptpoint Car Listing 1.6 and classified as problematic. This vulnerability affects unknown code of t CVE-2023-385807.8The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, watchOS 9.6. An CVE-2023-385818.8Buffer overflow in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation