CVE-2023-49598

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-495999.8An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially c CVE-2023-49605.4The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and in CVE-2023-496007.8An out-of-bounds write vulnerability exists in the PlyFile ply_cast_ascii functionality of libigl v2.5.0. A specially crafted .ply file can CVE-2023-496025.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion.CVE-2023-496037.5Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enab CVE-2023-496069.8A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted H CVE-2023-496077.5Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updati CVE-2023-49615.4The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1 CVE-2023-496108.1MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a me CVE-2023-496145.7Out of bounds write in firmware for some Intel(R) FPGA products before version 2.9.0 may allow escalation of privilege and information discl CVE-2023-496157.5Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to poten CVE-2023-496179.1The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attac