CVE-2023-40355

Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

1.08% chance of exploitation in the next 30 days, 65th percentile

Nuclei

medium · CWE-79

Published

2024-02-07

Updated

2025-06-17

Proof-of-concept exploits (1)

• ace-83/CVE-2023-403550★ · 2025-05-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40355.yaml

Security advisories

• https://www.axigen.com/knowledgebase/Axigen-WebMail-XSS-Vulnerability-CVE-2023-40355-_396…

References

• CVE Record
• NVD entry