CVE-2023-33736

Dcat-Admin vulnerable to Stored Cross-site Scripting

5.4 Medium

CVE-2023-33736 is a medium vulnerability (CVSS 5.4) in Dcatadmin Dcat Admin, published May 31, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.40%Up 0.4 points since Jun 1, 2023

What each source reports

NVD Score used 5.4

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Record: CVE-2023-33736
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 5.4

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Record: CVE-2023-33736
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2023-1594 5.4

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Record: EUVD-2023-1594
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p74v-mwvg-8ghp 5.4

Dcat-Admin vulnerable to Stored Cross-site Scripting

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Record: GHSA-p74v-mwvg-8ghp
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Record: CVE-2023-33736
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-p74v-mwvg-8ghp 5.4

Dcat-Admin vulnerable to Stored Cross-site Scripting

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Record: GHSA-p74v-mwvg-8ghp
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

dcatadmin dcat admin

Affected packages

Affected packages
Package	Affected	Fixed
`dcat/laravel-admin` Packagist	through 2.1.3-beta	None known
`dcat/laravel-admin` Packagist	through 2.1.3-beta, plus listed versions 0.1.00.8.00.8.10.8.20.9.0 Show 45 moreShow less 1.0.01.0.11.1.01.2.01.2.51.3.01.3.21.3.41.4.01.4.51.4.61.4.71.4.81.5.01.5.21.5.31.6.01.6.51.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.81.7.92.0.0-beta2.0.1-beta2.0.10-beta2.0.11-beta2.0.12-beta2.0.13-beta2.0.14-beta2.0.15-beta2.0.16-beta2.0.17-beta2.0.18-beta2.0.19-beta2.0.2-beta2.0.20-beta2.0.21-beta2.0.22-beta2.0.23-beta	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 11 versions. The JSON record has them.