CVE-2023-5024

LOW

Planno planning_biblio 23.04.04 - Cross-Site Scripting in Comment Handler

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-5024. PoCs published by PH03N1XSP.

AI-analyzed exploit summary This repository provides a detailed technical description of a reflected XSS vulnerability (CVE-2023-5024) in Planno version <= 23.04.04, including two attack paths and payload examples. It does not contain functional exploit code but offers clear steps to reproduce the issue.

Description

A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239865 was assigned to this vulnerability.

Exploits (1)

nomisec WRITEUP
by PH03N1XSP · poc
https://github.com/PH03N1XSP/CVE-2023-5024

This repository provides a detailed technical description of a reflected XSS vulnerability (CVE-2023-5024) in Planno version <= 23.04.04, including two attack paths and payload examples. It does not contain functional exploit code but offers clear steps to reproduce the issue.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Planno <= 23.04.04
Auth required
Prerequisites: Valid credentials for the Planno application
MITRE ATT&CK
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.239865
Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.239865
Exploit, Third Party Advisory media-coverage
https://youtu.be/evdhcUlD1EQ
Product product
https://www.planno.fr/

Scores

CVSS v3 3.5
EPSS 0.0058
EPSS Percentile 43.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
planno/planning_biblio 23.04.04
Published Sep 17, 2023
Tracked Since Feb 18, 2026