Vulnerability · Published Jan 12, 2023 · Assigned by VulDB
CVE-2023-0246earclink ESPCMS Content cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in ESPCMS from earclink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.6%top 52.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-218154 is the identifier assigned to this vulnerability.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- https://vuldb.com/?id.218154 vdb-entry, technical-description
- https://vuldb.com/?ctiid.218154 signature, permissions-required
- https://gitee.com/earclink/espcms/issues/I6812Q exploit, issue-tracking