{"id":"CVE-2023-46475","aliases":["EUVD-2023-50690","GHSA-fpg9-4hq2-2j28"],"status":"published","title":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create...","description":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00478,"percentile":0.41533,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-11-02T00:00:00Z","modified":"2026-10-28T02:30:38Z","products":[{"vendor":"easycorp","product":"zentao"}],"references":[{"url":"https://github.com/easysoft/zentaopms","tags":["x_transferred","Product","package"]},{"url":"https://github.com/elementalSec/CVE-Disclosures/blob/main/ZentaoPMS/CVE-2023-46475/CVE-2023-46475%20-%20Cross-Site%20Scripting%20%28Stored%29.md","tags":["x_transferred","Exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46475","tags":["advisory"]},{"url":"https://github.com/elementalSec/CVE-Disclosures/blob/main/ZentaoPMS/CVE-2023-46475/CVE-2023-46475%20-%20Cross-Site%20Scripting%20(Stored).md"},{"url":"https://github.com/advisories/GHSA-fpg9-4hq2-2j28"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46475.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46475","description":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.","status":"published","published":"2023-11-02T00:00:00Z","modified":"2024-09-17T13:12:47.255Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-50690","description":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.","status":"published","published":"2023-11-02T00:00:00Z","modified":"2024-09-17T13:12:47Z","updated_at":"2026-11-03T00:28:22.706109Z"}],"ghsa":[{"id":"GHSA-fpg9-4hq2-2j28","title":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create...","description":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.","status":"published","published":"2023-11-02T15:30:25Z","modified":"2023-11-18T05:04:51Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:04.479575Z"}],"nvd":[{"id":"CVE-2023-46475","description":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.","status":"published","published":"2023-11-02T13:15:08.413Z","modified":"2026-06-17T06:30:55.98Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"CVE-2023-46475","description":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.","status":"published","published":"2023-11-02T00:00:00Z","modified":"2026-10-28T02:30:38.518228312Z","updated_at":"2026-11-02T15:44:34.287121Z"}]}}