CVE-2023-7259

LowCVSS 2.4/10Last modified Sep 3, 2026

Description

** DISPUTED ** A vulnerability was found in zzdevelop lenosp up to 20230831. It has been classified as problematic. This affects an unknown part of the component Adduser Page. The manipulation of the argument username with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-266127. NOTE: The vendor rejected the issue because he claims that XSS which require administrative privileges are not of any use for attackers.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 24, 2024
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-72607.5Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitra CVE-2023-72617.8Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation CVE-2023-72637.3Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthor CVE-2023-72649.8The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, an CVE-2023-72656.2Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availabilit CVE-2023-72668.1Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or informati CVE-2023-72686.5The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authentic CVE-2023-72697.5The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping CVE-2023-72705.3An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 20 CVE-2023-72715.5Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2023-72727.5In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overf CVE-2023-72736.8Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization hea