CVE-2023-47099

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description field while creating the Virtual server.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-47106.1A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the compCVE-2023-471017.8The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installatiCVE-2023-471025.3UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.CVE-2023-471049.8tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messagesCVE-2023-471058.6exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without autCVE-2023-471066.5Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automaticallyCVE-2023-471078.8PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOCVE-2023-471087.5OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.CVE-2023-471098.1PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworCVE-2023-47118.1A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknoCVE-2023-471105.3blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An aCVE-2023-471113.7ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount