CVE-2023-53901 | THREATINT

Description

WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML file with CSS-based keylogging techniques to intercept password characters through background image requests.

PUBLISHED Reserved 2025-12-16 | Published 2025-12-16 | Updated 2025-12-18 | Assigner VulnCheck

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Problem types

URL Redirection to Untrusted Site ('Open Redirect')

Product status

Default status

unaffected

1.6.1

affected

Credits

Mirabbas Ağalarov finder

References

www.exploit-db.com/exploits/51566 (ExploitDB-51566) exploit

wbce-cms.org/ (WBCE CMS Product Webpage) product

www.vulncheck.com/...ripting-and-open-redirect-vulnerability (VulnCheck Advisory: WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability) third-party-advisory

cve.org (CVE-2023-53901)

nvd.nist.gov (CVE-2023-53901)

Download JSON