CVE-2023-5015

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239856.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	UCMS	1.4.7

References

https://github.com/Num-Nine/CVE/issues/3Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.239856Permissions Required, Third Party Advisory
https://vuldb.com/?id.239856Permissions Required, Third Party Advisory
https://github.com/Num-Nine/CVE/issues/3Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.239856Permissions Required, Third Party Advisory
https://vuldb.com/?id.239856Permissions Required, Third Party Advisory

Timeline

Published: Sep 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-501598.8In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be execute CVE-2023-50169.8A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function Drive CVE-2023-501627.2SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the Do CVE-2023-501649.8An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious CVE-2023-501658.6Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents.CVE-2023-501666.1Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.CVE-2023-501676.1Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.CVE-2023-501687.7Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.CVE-2023-50179.8A vulnerability was found in lmxcms up to 1.41. It has been rated as critical. Affected by this issue is some unknown functionality of the f CVE-2023-501725.3A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master co CVE-2023-501755.4Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and th CVE-2023-501768.8A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows a