CVE-2023-46394

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-463965.4Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters.CVE-2023-46407.5The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This CVE-2023-464009.8KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.CVE-2023-464019.8KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.CVE-2023-464027.5git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.CVE-2023-464049.9PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.CVE-2023-464075.5FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() f CVE-2023-464089.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.CVE-2023-464099.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.CVE-2023-46415.5A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second CVE-2023-464109.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.CVE-2023-464119.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.