CVE-2023-6720

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to the lack of proper sanitisation of field elements, allowing the attacker to trigger the malicious payload when the application loads.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-67217.5An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the CVE-2023-67227.5A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resultingCVE-2023-67239.8An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforCVE-2023-67248.8Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company HearingCVE-2023-67255.5An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND CVE-2023-67274.3Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to cCVE-2023-67283.3Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted fCVE-2023-67297.3Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." ConsequentCVE-2023-67308.8Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.CVE-2023-67314.3The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functCVE-2023-67324.8The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privCVE-2023-67336.5The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,