CVE-2023-26456 | BDVDB-2026-215865 Detail

Description#

Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12023-11-02Record published in the CVE List.
2. Version 22024-12-03Most recent update recorded in the CVE List.