← Vulnerability feed

Vulnerability record · CVE-2023-43346 · published 20 October 2023

CVE-2023-43346: Opensolution quick cms cross-site scripting vulnerability

Opensolution · Quick Cms

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend - Dashboard parameter in the Languages Menu component.

5.4 CVSS 3.1 Medium EPSS 0.49% · top 60.7% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend - Dashboard parameter in the Languages Menu component.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/sromanhu/CVE-2023-43346-Quick-CMS-Stored-XSS---Languages-Backend ExploitThird Party Advisory
https://github.com/sromanhu/Quick-CMS-Stored-XSS---Languages-Backend ExploitThird Party Advisory
https://github.com/sromanhu/CVE-2023-43346-Quick-CMS-Stored-XSS---Languages-Backend ExploitThird Party Advisory
https://github.com/sromanhu/Quick-CMS-Stored-XSS---Languages-Backend ExploitThird Party Advisory

Track CVE-2023-43346 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2024-58308Opensolution quick cms sql injection vulnerabilityQuick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login f…EPSS 0.67%8.6CVE-2023-43345Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.36%5.4CVE-2023-43342Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.49%5.4CVE-2023-43344Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.64%5.4CVE-2023-43343Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.68%4.3CVE-2012-6430Opensolution quick.cart cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows r…EPSS 3.9%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed

Source: NIST National Vulnerability Database (record CVE-2023-43346), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.