CVE-2023-24065

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for health charting.

• CWE-79
• CWE-79

• https://gist.github.com/abbisQQ/e0967d5b8355087c8e224bdd1ace3bf3Third Party Advisory
• https://github.com/shihjay2/docker-noshThird Party Advisory
• https://github.com/shihjay2/nosh2/issues/202Exploit, Third Party Advisory
• https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533Third Party Advisory
• https://noshemr.wordpress.comProduct, Third Party Advisory
• https://gist.github.com/abbisQQ/e0967d5b8355087c8e224bdd1ace3bf3Third Party Advisory
• https://github.com/shihjay2/docker-noshThird Party Advisory
• https://github.com/shihjay2/nosh2/issues/202Exploit, Third Party Advisory
• https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533Third Party Advisory
• https://noshemr.wordpress.comProduct, Third Party Advisory

Published

Jan 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24059Grand Theft Auto V for PC allows attackers to achieve partia…7.3
• CVE-2023-2406The Event Registration Calendar By vcita plugin, versions up…5.4
• CVE-2023-24060Haven 5d15944 allows Server-Side Request Forgery (SSRF) via …5
• CVE-2023-24062Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24063Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24064Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24068Signal Desktop before 6.2.0 on Windows, Linux, and macOS all…7.8
• CVE-2023-24069Signal Desktop before 6.2.0 on Windows, Linux, and macOS all…3.3
• CVE-2023-2407The Event Registration Calendar By vcita plugin, versions up…6.5
• CVE-2023-24070app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.16…6.1
• CVE-2023-24078Real Time Logic FuguHub v8.1 and earlier was discovered to c…8.8
• CVE-2023-2408A vulnerability, which was classified as critical, has been …6.5