CVE-2023-35858

Published: Jun 13, 2024Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

XPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker to obtain application information.

Affected (1)

Products: Moderncampus: Omni Cms

Moderncampus

1 product

Omni Cms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Moderncampus Omni Cms	Version 2023.1

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (2)

https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve

Source: cve@mitre.org

ExploitVendor Advisory

https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.