CVE-2023-4170

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in DedeBIZ 6.2.10. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Article Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-236186 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-417036.1User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when work CVE-2023-417046.1Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script c CVE-2023-417056.5Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load.CVE-2023-417066.5Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Av CVE-2023-417076.5Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load CVE-2023-417085.4References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypa CVE-2023-41715.3A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability af CVE-2023-417105.4User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attacke CVE-2023-417116.5SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash CVE-2023-417126.5SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.CVE-2023-417137.5SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.CVE-2023-417158.8SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileg