CVE-2023-0493

MEDIUM

BTCPay Server < 1.7.5 - HTML Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-0493. PoCs published by Manojkumar J.

AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in BTCPay Server v1.7.4. By injecting HTML into the API key label field, an attacker can render arbitrary HTML content when the API key is removed/deleted.

Description

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Manojkumar J · textwebappsmultiple
https://www.exploit-db.com/exploits/51254

This exploit demonstrates an HTML injection vulnerability in BTCPay Server v1.7.4. By injecting HTML into the API key label field, an attacker can render arbitrary HTML content when the API key is removed/deleted.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: BTCPay Server <=1.7.4
Auth required
Prerequisites: Valid user account on the target BTCPay Server instance
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 5.3
EPSS 0.0999
EPSS Percentile 93.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-76 CWE-74
Status published
Products (2)
btcpayserver/btcpay_server < 1.7.5
nuget/BTCPayServer.Client 0 - 1.7.5NuGet
Published Jan 26, 2023
Tracked Since Feb 18, 2026