CVE-2023-28485

A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.

• CWE-79

• http://packetstormsecurity.com/files/172649/Wekan-6.74-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://wekan.github.io/Product
• https://wekan.github.io/hall-of-fame/filebleed/Exploit, Vendor Advisory
• http://packetstormsecurity.com/files/172649/Wekan-6.74-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://wekan.github.io/Product
• https://wekan.github.io/hall-of-fame/filebleed/Exploit, Vendor Advisory

Published

Jun 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2848Movim prior to version 0.22 is affected by a Cross-Site WebS…8.8
• CVE-2023-28480An issue was discovered in Tigergraph Enterprise 3.7.0. The …6.5
• CVE-2023-28481An issue was discovered in Tigergraph Enterprise 3.7.0. Ther…8.8
• CVE-2023-28482An issue was discovered in Tigergraph Enterprise 3.7.0. A si…6.5
• CVE-2023-28483An issue was discovered in Tigergraph Enterprise 3.7.0. The …8.8
• CVE-2023-28484In libxml2 before 2.10.4, parsing of certain invalid XSD sch…6.5
• CVE-2023-28486Sudo before 1.9.13 does not escape control characters in log…5.3
• CVE-2023-28487Sudo before 1.9.13 does not escape control characters in sud…5.3
• CVE-2023-28488client.c in gdhcp in ConnMan through 1.41 could be used by n…6.5
• CVE-2023-28489A vulnerability has been identified in CP-8031 MASTER MODULE…9.8
• CVE-2023-28490Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-28491Improper Neutralization of Special Elements used in an SQL C…7.2