CVE-2023-23637

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH ...

7.6 High

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder. This may allow attackers to steal Protected Health Information.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.65%Down 0.2 points since Jan 18, 2023

What each source reports

NVD Score used 7.6

Record: CVE-2023-23637
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 7.6

Record: CVE-2023-23637
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2023-27725 7.6

Record: EUVD-2023-27725
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fqgh-j4x2-5297 7.6

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH ...

Record: GHSA-fqgh-j4x2-5297
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 7.6

Record: CVE-2023-23637
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Updated: 2026-11-02

Affected products

unistra impatient

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-23637 is a high vulnerability (CVSS 7.6) in Unistra Impatient, published January 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. No source names a fixed version.