CVE-2023-46448

Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33rd percentile

Published

2023-11-01

Updated

2024-09-12

Proof-of-concept exploits (1)

• https://blog.0xzon.dev/2023-10-15-Mejiro-Reflected-XSS-Via-Remote-File-Inclusion-CVE-2023…

Security advisories

• https://blog.0xzon.dev/2023-10-15-Mejiro-Reflected-XSS-Via-Remote-File-Inclusion-CVE-2023…
• dmpop/mejiro/commit/309639339f5816408865902befe8c90cb6862537

References

• CVE Record
• NVD entry