CVE-2023-41425

MediumCVSS 6.1

Published: 07/11/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

54.31%

99th percentile - higher than 99% of all known CVEs

Summary

A Cross-Site Scripting vulnerability in Wonder CMS versions 3.2.0 through 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.

Risk Assessment

An attacker can inject malicious scripts, leading to session hijacking, admin account takeover, or website defacement.

Recommendation

Immediately update Wonder CMS to the latest available version and restrict access to the admin panel to trusted IP addresses only.

Original NVD description (English source)

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.