{"id":"CVE-2023-44915","aliases":["EUVD-2023-49238","GHSA-p827-3v67-x54p"],"status":"published","title":"A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4...","description":"A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00323,"percentile":0.25516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-06-25T00:00:00Z","modified":"2026-07-05T01:18:54Z","references":[{"url":"https://github.com/dfar2008/c3crm"},{"url":"https://github.com/dfar2008/c3crm/tree/master/Login.php#L108"},{"url":"https://github.com/timosarkar/vulnerabilities/tree/main/CVE-2023-44915"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44915"},{"url":"http://c3crm.com"},{"url":"https://github.com/advisories/GHSA-p827-3v67-x54p"}],"sources":{"cve":[{"id":"CVE-2023-44915","description":"A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.","status":"published","published":"2025-06-25T00:00:00Z","modified":"2026-07-05T00:59:48.278Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:21.612665Z"}],"euvd":[{"id":"EUVD-2023-49238","description":"A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.","status":"published","published":"2025-06-25T00:00:00Z","modified":"2026-07-05T00:59:48Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:16.016392Z"}],"ghsa":[{"id":"GHSA-p827-3v67-x54p","title":"A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4...","description":"A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.","status":"published","published":"2025-06-26T21:31:12Z","modified":"2025-06-26T21:31:13Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:49.894932Z"}],"nvd":[{"id":"CVE-2023-44915","description":"A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.","status":"published","published":"2025-06-25T17:15:36.323Z","modified":"2026-07-05T01:18:54.977Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:21.774456Z"}]}}