CVE-2023-36217

Deeper analysis

CVE-2023-36217 is a cross-site scripting vulnerability, tracked as CWE-79, that affects the image manager function in Xoops CMS version 2.5.10. The flaw resides in the category name field and carries a CVSS 3.1 score of 9.0, reflecting network attack vector, low complexity, and high impact across confidentiality, integrity, and availability when the vulnerable component is embedded in a larger application.

An authenticated remote attacker with low privileges can supply a crafted category name that executes arbitrary script in the context of other users' sessions. Successful exploitation yields the ability to hijack accounts, exfiltrate data, or perform actions on behalf of victims who view the manipulated image manager content, owing to the reflected or stored nature of the script injection.

Public references point to the XoopsCore25 v2.5.10 release tags and associated Exploit-DB entries, indicating that the published version contains the defect and that exploit code has been made available; administrators are therefore advised to monitor subsequent XOOPS releases for corrective patches that address the input-handling weakness in the image manager.

The EPSS score reached a peak of 0.0817 after disclosure, demonstrating a measurable increase in exploitation interest that warrants attention beyond the initial announcement.