CVE-2023-24737
published 2023-03-06CVE-2023-24737: PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.
PriorityP333medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.17%
63.4th percentile
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sigb | pmb | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
PMB v7.4.6 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2023-24737 [MEDIUM] PMB v7.4.6 - Cross-Site Scripting
PMB v7.4.6 - Cross-Site Scripting
PMB v7.4.6 allows an attacker to perform a reflected XSS on export_z3950.php via the 'query' parameter.
Template:
id: CVE-2023-24737
info:
name: PMB v7.4.6 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
PMB v7.4.6 allows an attacker to perform a reflected XSS on export_z3950.php via the 'query' parameter.
impact: |
Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
remediation: |
Apply the latest security patch or upgrade to a non-vulnerable version of PMB.
reference:
- https://github.com/AetherBlack/CVE/blob/main/PMB/readme.md
- https://github.com/AetherBlack/C
2023-03-06
Published