Medium · 4.8 CVE-2023-22427 EUVD-2023-26590GHSA-pffm-c6m3-rc4c

Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker wi…

Published Feb 24, 2023 · Updated Mar 12, 2025 · Assigned by jpcert

Vendor: SHIRASAGI Project Product: SHIRASAGI

Description

Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker with an administrative privilege to inject an arbitrary script.

Affected products

Vendor	Product	Affected	Fixed
SHIRASAGI Project	SHIRASAGI	v1.16.2 and earlier versions	—

References

https://www.ss-proj.org/
https://github.com/shirasagi/shirasagi
https://www.ss-proj.org/support/938.html
https://jvn.jp/en/jp/JVN18765463/