CVE-2023-28651

Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3....

4.8 Medium

Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

62.4%Up 62.4 points since Jun 1, 2023

What each source reports

NVD Score used 4.8

Record: CVE-2023-28651
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 4.8

Record: CVE-2023-28651
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2023-32312 4.8

Record: EUVD-2023-32312
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8xq3-xxw7-pvf5 4.8

Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3....

Record: GHSA-8xq3-xxw7-pvf5
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28651 is a medium vulnerability (CVSS 4.8) in Contec Conprosys Hmi System, published June 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 62.4%, the 99th percentile. No source names a fixed version.