CVE-2023-39096

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-390975.4WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.CVE-2023-391068.8An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls ConstrCVE-2023-391079.1An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrCVE-2023-391088.8rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/coCVE-2023-391098.8rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/coCVE-2023-391108.8rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulneraCVE-2023-391126.5ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.CVE-2023-391135.5ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggereCVE-2023-391145.5ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerabiCVE-2023-391159.8install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document.CVE-2023-391217.2emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.CVE-2023-391229.8BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (a
CVE-2023-39096: Medium severity, CVSS 5.4 | Vulnix