CVE-2023-31546

CRITICAL

DedeBIZ 6.0.3 - Cross-Site Scripting via Search Feature

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-31546. PoCs published by ran9ege.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2023-31546, an XSS vulnerability in DedeBIZ v6.0.3. It includes the attack vector, payload, and HTTP request details, demonstrating the vulnerability in the search functionality.

Description

Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.

Exploits (1)

nomisec WRITEUP 1 stars
by ran9ege · poc
https://github.com/ran9ege/CVE-2023-31546

This repository provides a detailed technical analysis of CVE-2023-31546, an XSS vulnerability in DedeBIZ v6.0.3. It includes the attack vector, payload, and HTTP request details, demonstrating the vulnerability in the search functionality.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: DedeBIZ v6.0.3
No auth needed
Prerequisites: Access to the search functionality in DedeBIZ v6.0.3
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 9.6
EPSS 0.4936
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-79
Status published
Products (1)
dedebiz/dedebiz 6.0.3
Published Dec 14, 2023
Tracked Since Feb 18, 2026