CVE-2023-38970
Badaso vulnerable to cross-site scripting
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
- Record
CVE-2023-38970- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
- Record
CVE-2023-38970- Updated
- 2026-11-02
EUVDEUVD-2023-2230 No score
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
- Record
EUVD-2023-2230- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7422-7rq6-j4qv
Badaso vulnerable to cross-site scripting
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
- Record
GHSA-7422-7rq6-j4qv- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-7422-7rq6-j4qv
Badaso vulnerable to cross-site scripting
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
- Record
GHSA-7422-7rq6-j4qv- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
- Record
CVE-2023-38970- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uasoft-indonesia/badasoPackagist |
through 2.9.7 | None known |
uasoft-indonesia/badasoPackagist |
through 2.9.7, plus listed versions 1.0.01.0.0-alpha.11.0.0-alpha.101.0.0-alpha.111.0.0-alpha.12 Show 45 moreShow less1.0.0-alpha.131.0.0-alpha.141.0.0-alpha.151.0.0-alpha.161.0.0-alpha.171.0.0-alpha.181.0.0-alpha.191.0.0-alpha.21.0.0-alpha.201.0.0-alpha.211.0.0-alpha.221.0.0-alpha.231.0.0-alpha.241.0.0-alpha.251.0.0-alpha.261.0.0-alpha.271.0.0-alpha.281.0.0-alpha.291.0.0-alpha.31.0.0-alpha.301.0.0-alpha.311.0.0-alpha.321.0.0-alpha.331.0.0-alpha.341.0.0-alpha.351.0.0-alpha.361.0.0-alpha.371.0.0-alpha.381.0.0-alpha.391.0.0-alpha.41.0.0-alpha.401.0.0-alpha.51.0.0-alpha.61.0.0-alpha.71.0.0-alpha.81.0.0-alpha.91.0.0-rc1.0.0-rc.11.0.0-rc.101.0.0-rc.111.0.0-rc.121.0.0-rc.131.0.0-rc.141.0.0-rc.151.0.0-rc.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38970 is a medium vulnerability (CVSS 5.4) in Uatech Badaso, published August 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. No source names a fixed version.
References
github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md
panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-new-member
nvd.nist.gov/vuln/detail/CVE-2023-38970
Left out here: 69 versions. The JSON record has them.