CVE-2023-53887

Published: Dec 15, 2025Modified: Jun 17, 2026

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new pages. Attackers can craft malicious image source and onerror attributes to execute arbitrary JavaScript code in victim's browser.

Affected (1)

Products: Zomp: Zomplog

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zomp Zomplog	Version 3.9

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog/

Source: disclosure@vulncheck.com

Product

https://www.exploit-db.com/exploits/51625

Source: disclosure@vulncheck.com

ExploitThird Party AdvisoryVDB Entry

https://www.vulncheck.com/advisories/zomplog-cross-site-scripting-vulnerability-via-page-creation

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/51625

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.