CVE-2023-37225: Pexip infinity cross-site scripting vulnerability

Pexip · Pexip Infinity

Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.

6.1 CVSS 3.1 Medium EPSS 0.31% · top 78.5% CWE-79 · Cross-site scripting

6.1CVSS 3.1 base score

0.31%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Pexip Infinity Pexip

References

Link	Tags
https://docs.pexip.com/admin/security_bulletins.htm	MitigationVendor Advisory
https://docs.pexip.com/admin/security_bulletins.htm	MitigationVendor Advisory

Track CVE-2023-37225 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-11805Pexip infinity improper input validation vulnerabilityPexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN.EPSS 1.4%25 Sep 2020 9.8CVE-2015-4719Pexip infinity improper privilege management vulnerabilityThe client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.EPSS 1.5%24 Sep 2020 9.8CVE-2017-6551Pexip infinity improper input validation vulnerabilityPexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Co…EPSS 3.5%2 May 2017 9.1CVE-2025-59683Pexip infinity incorrect authorization vulnerabilityPexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Lega…EPSS 0.33%25 Dec 2025 8.2CVE-2022-27933Pexip infinity vulnerabilityPexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.EPSS 1.1%17 Jul 2022 8.2CVE-2022-26656Pexip infinity vulnerabilityPexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.EPSS 1.1%17 Jul 2022 7.5CVE-2025-66379Pexip infinity vulnerabilityPexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a cr…EPSS 0.37%25 Dec 2025 7.5CVE-2025-66377Pexip infinity missing authentication for critical function vulnerabilityPexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access…EPSS 0.21%25 Dec 2025

Source: NIST National Vulnerability Database (record CVE-2023-37225), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.