CVE-2023-48255

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482566.3The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s seCVE-2023-482578.8The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) witCVE-2023-482588.1The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’CVE-2023-482597.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-48266.1The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrarCVE-2023-482607.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-482617.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-482629.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482639.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482649.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482659.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482669.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Exe
CVE-2023-48255: Medium severity, CVSS 6.1 | Vulnix