{"id":"CVE-2023-27150","aliases":["EUVD-2023-3166","GHSA-8wjx-p2f8-5rjp"],"status":"published","title":"OpenCRX Cross-site Scripting vulnerability","description":"openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00397,"percentile":0.34288,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-12-26T00:00:00Z","modified":"2026-10-28T02:31:12Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opencrx:opencrx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opencrx:opencrx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.0"}]}],"versions":["4.3-alpha-1","4.3-alpha-10","4.3-alpha-11","4.3-alpha-2","4.3-alpha-3","4.3-alpha-4","4.3-alpha-5","4.3-alpha-6","4.3-alpha-7","4.3-alpha-8","4.3-alpha-9","4.3.0","5.0.0","5.0.1","5.1.0","5.2.0"]}],"products":[{"vendor":"opencrx","product":"opencrx"}],"references":[{"url":"https://www.opencrx.org/","tags":["x_transferred","Product","web"]},{"url":"https://www.esecforte.com/cve-2023-27150-cross-site-scripting-xss/","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27150","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8wjx-p2f8-5rjp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27150.json","tags":["advisory"]},{"url":"https://github.com/opencrx/opencrx","tags":["package"]},{"url":"https://www.esecforte.com/cve-2023-27150-cross-site-scripting-xss","tags":["web"]},{"url":"https://www.opencrx.org","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-27150","description":"openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.","status":"published","published":"2023-12-26T00:00:00Z","modified":"2024-08-27T20:01:19.836Z","updated_at":"2026-11-02T14:35:26.261013Z"}],"euvd":[{"id":"EUVD-2023-3166","description":"openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.","status":"published","published":"2023-12-26T00:00:00Z","modified":"2024-08-27T20:01:19Z","updated_at":"2026-11-03T00:56:09.903799Z"}],"ghsa":[{"id":"GHSA-8wjx-p2f8-5rjp","title":"OpenCRX Cross-site Scripting vulnerability","description":"openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.","status":"published","published":"2023-12-26T06:30:33Z","modified":"2024-01-04T17:33:36Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:29.411214Z"}],"nvd":[{"id":"CVE-2023-27150","description":"openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.","status":"published","published":"2023-12-26T04:15:07.713Z","modified":"2026-06-17T05:44:27.42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"GHSA-8wjx-p2f8-5rjp","title":"OpenCRX Cross-site Scripting vulnerability","description":"openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.","status":"published","published":"2023-12-26T06:30:33Z","modified":"2024-02-19T05:51:48.526768Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"CVE-2023-27150","description":"openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.","status":"published","published":"2023-12-26T00:00:00Z","modified":"2026-10-28T02:31:12.574585367Z","updated_at":"2026-11-02T15:44:31.135751Z"}]}}