{"id":"CVE-2023-0493","aliases":["EUVD-2023-0312","GHSA-33gv-rvgq-gpxp"],"status":"published","title":"Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver","description":"Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.08118,"percentile":0.94904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-74","CWE-76"],"published":"2023-01-26T00:00:00Z","modified":"2026-10-28T02:31:06Z","exploits":[{"source":"exploitdb","id":"EDB-51254","title":"BTCPay Server v1.7.4 - HTML Injection","type":"webapps","platform":"multiple","date":"2023-04-05","verified":true,"url":"https://www.exploit-db.com/exploits/51254"}],"products":[{"vendor":"btcpayserver","product":"btcpay_server"},{"vendor":"btcpayserver","product":"btcpayserver/btcpayserver"}],"references":[{"url":"https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a","tags":["x_transferred","Patch","web"]},{"url":"http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html","tags":["x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0493","tags":["advisory"]},{"url":"https://github.com/btcpayserver/btcpayserver/commit/02070d65836cd24627929b3403efbae8de56039a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-33gv-rvgq-gpxp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0493.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-0493","title":"Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver","description":"Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.\n\n","status":"published","published":"2023-01-26T00:00:00Z","modified":"2025-03-31T16:46:03.476Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-76"],"updated_at":"2026-11-02T14:35:35.256261Z"}],"euvd":[{"id":"EUVD-2023-0312","description":"Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.\n\n","status":"published","published":"2023-01-26T00:00:00Z","modified":"2025-03-31T16:46:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:46.759966Z"}],"ghsa":[{"id":"GHSA-33gv-rvgq-gpxp","title":"Withdrawn Advisory: HTML injections in BTCPayServer","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because all of the files affected by this vulnerability lie in the [BTCPayServer folder](https://github.com/btcpayserver/btcpayserver/tree/master/BTCPayServer), which is not in the NuGet ecosystem. The [BTCPayServer folder](https://github.com/btcpayserver/btcpayserver/tree/master/BTCPayServer.Client), corresponding to the [BTCPayServer NuGet entry](https://www.nuget.org/packages/BTCPayServer.Client), does not contain any files that were changed to fix the vulnerability.\n\n## Original Description\nImproper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.","status":"withdrawn","published":"2023-01-27T00:30:18Z","modified":"2023-11-01T06:05:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-76"],"updated_at":"2026-11-02T14:37:11.48574Z"}],"nvd":[{"id":"CVE-2023-0493","description":"Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.\n\n","status":"published","published":"2023-01-26T23:15:15.92Z","modified":"2026-06-17T05:25:40.703Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-76","CWE-74"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-0493","title":"Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver","description":"Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.\n\n","status":"published","published":"2023-01-26T00:00:00Z","modified":"2026-10-28T02:31:06.873013288Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-76"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"GHSA-33gv-rvgq-gpxp","title":"Withdrawn Advisory: HTML injections in BTCPayServer","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because all of the files affected by this vulnerability lie in the [BTCPayServer folder](https://github.com/btcpayserver/btcpayserver/tree/master/BTCPayServer), which is not in the NuGet ecosystem. The [BTCPayServer folder](https://github.com/btcpayserver/btcpayserver/tree/master/BTCPayServer.Client), corresponding to the [BTCPayServer NuGet entry](https://www.nuget.org/packages/BTCPayServer.Client), does not contain any files that were changed to fix the vulnerability.\n\n## Original Description\nImproper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.","status":"withdrawn","published":"2023-01-27T00:30:18Z","modified":"2026-09-10T03:49:50.967474527Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-76"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}