CVE-2023-1635

LOW

OTCMS 6.72 - Cross-Site Scripting via AutoRun Function in apiRun.php

Title source: llm
STIX 2.1

Description

A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.

References (3)

Core 3
Core References
Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.224017
Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.224017

Scores

CVSS v3 3.5
EPSS 0.0062
EPSS Percentile 44.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
otcms/otcms 6.72
Published Mar 25, 2023
Tracked Since Feb 18, 2026