CVSS 3.1 Score 4.8 of 10 (medium)


Published Jul 13, 2023
Updated: Jul 21, 2023


CVE-2023-37785 is a cross-site scripting (XSS) vulnerability that affects ImpressCMS versions 1.4.5 and earlier. Attackers can exploit this vulnerability by injecting a crafted payload into the smile_code parameter of the /editprofile.php component, allowing them to execute arbitrary web scripts or HTML. The vulnerability has a CVSS base score of 4.8, indicating a medium severity level. It requires high privileges and user interaction, with a low complexity attack vector through the network. The impact score is 2.7, with low integrity and confidentiality impact, and no availability impact. Affected products include fmOIGq, iVbwjx, QtrPwI, and many others. Organizations should remediate this vulnerability by updating to a version of ImpressCMS that is newer than 1.4.5 to mitigate the potential danger posed by attackers exploiting this XSS vulnerability for unauthorized script execution or manipulation of web content on affected systems.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-37785 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options