CVE-2023-48003

An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' in the WebSocket messages.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.46% chance of exploitation in the next 30 days, 38th percentile

Published

2023-12-26

Updated

2024-08-02

Proof-of-concept exploits (2)

• https://docs.unsafe-inline.com/0day/asp.net-zero-v12.3.0-html-injection-leads-to-open-red…
• passtheticket/vulnerability-research/blob/main/aspnetzero_html_injection_via_websockets_m…

References

• CVE Record
• NVD entry

Related

• CVE-2020-35850
• CVE-2022-28987
• CVE-2023-31492
• CVE-2024-24409
• CVE-2024-38200
• CVE-2025-9435