CVE-2023-23927

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.

• CWE-79

• https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03Release Notes
• https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hqExploit, Vendor Advisory
• https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4Exploit, Third Party Advisory
• https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03Release Notes
• https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hqExploit, Vendor Advisory
• https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4Exploit, Third Party Advisory

Published

Mar 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23921The vulnerability was found Moodle which exists due to insuf…6.1
• CVE-2023-23922The vulnerability was found Moodle which exists due to insuf…6.1
• CVE-2023-23923The vulnerability was found Moodle which exists due to insuf…8.2
• CVE-2023-23924Dompdf is an HTML to PDF converter. The URI validation on do…9.8
• CVE-2023-23925Switcher Client is a JavaScript SDK to work with Switcher AP…7.5
• CVE-2023-23926APOC (Awesome Procedures on Cypher) is an add-on library for…8.1
• CVE-2023-23928reason-jose is a JOSE implementation in ReasonML and OCaml.`…9.8
• CVE-2023-23929vantage6 is a privacy preserving federated learning infrastr…8.8
• CVE-2023-2393A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
• CVE-2023-23930vantage6 is privacy preserving federated learning infrastruc…7.2
• CVE-2023-23931cryptography is a package designed to expose cryptographic p…6.5
• CVE-2023-23932OpenDDS is an open source C++ implementation of the Object M…7.5