{"id":"CVE-2023-45958","aliases":["EUVD-2023-50221","GHSA-4j8p-h8p2-rc88"],"status":"published","title":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS)...","description":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00357,"percentile":0.29639,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-10-18T00:00:00Z","modified":"2026-10-28T02:30:44Z","products":[{"vendor":"thirtybees","product":"thirty_bees"}],"references":[{"url":"https://zigrin.com/advisories/thirty-bees-reflected-cross-site-scripting-xss/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/thirtybees/thirtybees/commit/2c99464376ad7b3c95f220163a2411e35274c3ba","tags":["x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45958","tags":["advisory"]},{"url":"https://zigrin.com/advisories/thirty-bees-reflected-cross-site-scripting-xss"},{"url":"https://github.com/advisories/GHSA-4j8p-h8p2-rc88"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45958.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-45958","description":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.","status":"published","published":"2023-10-18T00:00:00Z","modified":"2024-09-13T14:46:12.546Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-50221","description":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.","status":"published","published":"2023-10-18T00:00:00Z","modified":"2024-09-13T14:46:12Z","updated_at":"2026-11-03T00:55:55.933062Z"}],"ghsa":[{"id":"GHSA-4j8p-h8p2-rc88","title":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS)...","description":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.","status":"published","published":"2023-10-19T00:30:19Z","modified":"2024-04-04T08:46:46Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:01.229221Z"}],"nvd":[{"id":"CVE-2023-45958","description":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.","status":"published","published":"2023-10-18T22:15:09.573Z","modified":"2026-06-17T06:29:49.89Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"CVE-2023-45958","description":"Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.","status":"published","published":"2023-10-18T00:00:00Z","modified":"2026-10-28T02:30:44.780397739Z","updated_at":"2026-11-02T15:44:34.287121Z"}]}}