CVE-2023-38973

MediumCVSS 5.4

Published: 25/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

In version 2.9.7 of Badaso, there is a stored XSS vulnerability in the Add Tag function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.

Risk Assessment

This vulnerability could lead to session hijacking or data theft, posing a significant security threat to the application and its users.

Recommendation

It is recommended to update to the latest version of Badaso and implement proper input filtering and validation to mitigate XSS risks.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.