CVE-2023-7035

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\standard\templates\post.php of the component Setting Handler. The manipulation of the argument sitename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-70365.4A vulnerability was found in automad up to 1.10.9. It has been classified as problematic. This affects the function upload of the file FileC CVE-2023-70378.8A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the f CVE-2023-70386.5A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file CVE-2023-70399.8A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexpo CVE-2023-70406.5A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown CVE-2023-70415.4A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some CVE-2023-70425.5A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c CVE-2023-70435.5Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\Ne CVE-2023-70445.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St CVE-2023-70456.1A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By l CVE-2023-70467.5The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Se CVE-2023-70474.4Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager