CVE-2023-46287

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/NagVis/nagvis/compare/nagvis-1.9.37...nagvis-1.9.38Third Party Advisory
https://github.com/NagVis/nagvis/pull/356Third Party Advisory
https://github.com/NagVis/nagvis/pull/356/commits/d660591b23e5cfea4d1be2d3fb8f3855aa6020fbPatch, Third Party Advisory
https://github.com/NagVis/nagvis/compare/nagvis-1.9.37...nagvis-1.9.38Third Party Advisory
https://github.com/NagVis/nagvis/pull/356Third Party Advisory
https://github.com/NagVis/nagvis/pull/356/commits/d660591b23e5cfea4d1be2d3fb8f3855aa6020fbPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00000.html

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-462884.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2 CVE-2023-462897.5Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send m CVE-2023-46294.3The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the save_config() function in v CVE-2023-462908.1Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the F CVE-2023-462943.4An issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted locally, and can be decrypted to cleartext passw CVE-2023-462959.8An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can ex CVE-2023-462975.1An issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_V3_1.11.0 221019 devices. A WAN attacker can make the admin interface unreachabl CVE-2023-462987.5Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a CVE-2023-46304.3An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.CVE-2023-463009.8iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integratio CVE-2023-463019.8iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.CVE-2023-463029.8Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vu