Evolution CMS Cross-site Scripting vulnerability

MEDIUM 6.1CVE-2023-43341 · GHSA-5h47-9rm5-fx3f · Published 19/10/2023 · updated 17/06/2026

In short

CVE-2023-43341 is a MEDIUM (CVSS 6.1) vulnerability affecting evolutioncms/evolution, evolution cms (evo).
Chance of exploitation in the next 30 days (EPSS): 0.62%, higher than 49.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
evolutioncms/evolution Packagist	`≤ 3.2.3`	No fix yet
evolution cms evo	`= 3.2.3`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.

NVD description

Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.

References

nvd.nist.gov/vuln/detail/CVE-2023-43341 · ADVISORY
evolution-cms/evolution · PACKAGE
sromanhu/CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection- · WEB
sromanhu/Evolution-Reflected-XSS---Installation-Connection- · WEB

More vulnerabilities in evolutioncms/evolution

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

evolutioncms/evolution

Packagist

≤ 3.2.3

No fix yet

evolution cms

evo

= 3.2.3

No fix yet

Description

Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.

NVD description

Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.

More vulnerabilities in evolutioncms/evolution

See all →