CVE-2023-49258

CVE-2023-49258: Reflected cross-site scripting vulnerability

Vendor Hongdian

Product H8951-4G-ESP

Weakness CWE-79 · XSS

Published January 12, 2024

Last update June 3, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tool.cgi" in the "data" parameter.

Key dates

02Disclosure timeline

January 12, 2024 CVE published

June 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-49258 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2026-57763 WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-57358 WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-8699 Stored Cross-Site Scripting (XSS) in TP-Link Archer C5 Web Management Interface CVE-2026-57354 WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-57360 WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability