CVE-2023-49575: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse…

PriorityP427medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.25%

16.6th percentile

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
flexense	disk_pulse_enterprise	—	—
flexense	sync_breeze_enterprise_server	—	—
flexense	vx_search	—	—
flexense	vx_search_enterprise	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.