CVE-2023-26577 HIGH

CVE-2023-26577: Stored Cross-site Scripting In IDAttend’s IDWeb Application

Vendor Idattend Pty Ltd

Product IDWeb

Weakness CWE-79 · XSS

Published October 25, 2023

Last update September 17, 2024

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user.

Key dates

02Disclosure timeline

October 25, 2023 CVE published

September 17, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-26577 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-34797 WordPress Simple Popup Manager plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability CVE-2023-48456 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) CVE-2022-1643 Birthdays Widget <= 1.7.18 - Admin+ Stored Cross Site Scripting CVE-2024-47925 Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2025-24731 WordPress IP2Location Country Blocker plugin <= 2.38.3 - Cross Site Scripting (XSS) vulnerability