CVEvulnerability
CVE-2023-53903
5.1 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.1 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files with script tags that execute when the file is viewed, enabling persistent cross-site scripting attacks.
Affected configurations
• websitebaker websitebaker 2.13.3
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://websitebaker.org/pages/en/home.php Product
- https://www.exploit-db.com/exploits/51553 Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/websitebaker-stored-cross-site-scripting-via-svg-file-upload Exploit, Third Party Advisory