CVE-2023-36217

CRITICAL

Xoops CMS <2.5.10 - XSS

Title source: llm

Description

Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager function.

Exploits (1)

exploitdb WORKING POC

by tmrswrr · textwebappsphp

https://www.exploit-db.com/exploits/51520

View Code ZIP pw:eip

References (2)

[Release Notes] https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.10

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/51520

Scores

CVSS v3 9.0

EPSS 0.0391

EPSS Percentile 88.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Details

CWE

CWE-79

Status published

Products (1)

xoops/xoops 2.5.10

Published Aug 03, 2023

Tracked Since Feb 18, 2026