CVE-2023-53904

EIP tracks 1 public exploit for CVE-2023-53904. PoCs published by Furkan Karaarslan.

AI-analyzed exploit summary This exploit demonstrates an authenticated stored XSS vulnerability in Xenforo 2.2.12 by injecting malicious JavaScript via the smilie category title field. The payload triggers an alert with the document domain upon creation.

Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie category title parameter. Attackers can create a smilie category with a malicious script that will execute when the admin panel is loaded, potentially enabling further client-side attacks.