Skip to content
Fencer Vulns
low 2.4

CVE-2023-2058 json

EyouCms HTTP POST Request cross site scripting

published 2023-04-14 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-33584

cvss
2.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

A vulnerability was found in EyouCms up to 1.6.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /yxcms/index.php?r=admin/extendfield/mesedit&tabid=12&id=4 of the component HTTP POST Request Handler. The manipulation of the argument web_ico leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225943.

Patch / fix

  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.182.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.182.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.182.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.182.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.182.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.182.1.150500.6.85.2
  • kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
  • kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1

suse advisories SUSE-SU-2026:3595-1SUSE-SU-2026:3810-1SUSE-SU-2026:3790-1SUSE-SU-2026:23244-1SUSE-SU-2026:23241-1SUSE-SU-2026:23194-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.37.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.37.1

opensuse advisories openSUSE-SU-2026:21555-1

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/sleepyvv/vul_report/blob/main/EYOUCMS/XSS2.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CNA 3.0 2.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CNA 2.0 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

  • n/a EyouCms

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.