← Vulnerability feed

Vulnerability record · CVE-2023-24322 · published 9 February 2023

CVE-2023-24322: Mojoportal cross-site scripting vulnerability

Mojoportal · Mojoportal

A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.

6.1 CVSS 3.1 Medium EPSS 32% · top 1.8% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md ExploitThird Party Advisory
https://github.com/i7MEDIA/mojoportal/ Product
https://www.mojoportal.com/ Product
https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md ExploitThird Party Advisory
https://github.com/i7MEDIA/mojoportal/ Product
https://www.mojoportal.com/ Product

Track CVE-2023-24322 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-44011Mojoportal code injection vulnerabilityAn issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin m…EPSS 1.4%9.8CVE-2023-44008Mojoportal unrestricted file upload vulnerabilityFile Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.EPSS 1.3%9.8CVE-2023-44009Mojoportal unrestricted file upload vulnerabilityFile Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.EPSS 1.4%8.8CVE-2023-24323Mojoportal xml external entity (xxe) vulnerabilityMojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.EPSS 1.2%8.8CVE-2022-40341Mojoportal unrestricted file upload vulnerabilitymojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG f…EPSS 1.2%6.5CVE-2025-28367Mojoportal improper access control vulnerabilitymojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this v…EPSS 1.9%6.5CVE-2022-40123Mojoportal path traversal vulnerabilitymojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability all…EPSS 1.1%6.1CVE-2023-44012Mojoportal cross-site scripting vulnerabilityCross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.a…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2023-24322), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.