CVE-2023-53906

Description

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.

Weakness classification

• disclosure@vulncheck.com: CWE-79

Primary references

• disclosure@vulncheck.com — Exploit, Third Party Advisory
• disclosure@vulncheck.com — Product
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory