{"id":"CVE-2023-45540","aliases":["EUVD-2023-49832","GHSA-q6rf-xpm8-9wqx"],"status":"published","title":"An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary...","description":"An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0068,"percentile":0.52685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-74"],"published":"2023-10-16T00:00:00Z","modified":"2026-06-17T06:28:48Z","exploits":[{"source":"pocgithub","id":"SoundarXploit/CVE-2023-45540","title":"SoundarXploit/CVE-2023-45540","date":"2023-10-06","url":"https://github.com/SoundarXploit/CVE-2023-45540"}],"products":[{"vendor":"jorani","product":"leave_management_system"}],"references":[{"url":"https://github.com/soundarkutty/HTML-Injection/blob/main/POC.md","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45540"},{"url":"https://github.com/advisories/GHSA-q6rf-xpm8-9wqx"}],"sources":{"cve":[{"id":"CVE-2023-45540","description":"An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.","status":"published","published":"2023-10-16T00:00:00Z","modified":"2024-09-16T18:32:56.858Z","updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-49832","description":"An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.","status":"published","published":"2023-10-16T00:00:00Z","modified":"2024-09-16T18:32:56Z","updated_at":"2026-11-03T00:55:32.095421Z"}],"ghsa":[{"id":"GHSA-q6rf-xpm8-9wqx","title":"An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary...","description":"An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.","status":"published","published":"2023-10-17T00:30:17Z","modified":"2024-04-11T21:02:47Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:57:06.434267Z"}],"nvd":[{"id":"CVE-2023-45540","description":"An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.","status":"published","published":"2023-10-16T22:15:12.733Z","modified":"2026-06-17T06:28:48.48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:08:37.83429Z"}]}}