CVE-2023-3085

A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663.

• CWE-79
• CWE-79

• https://github.com/x-wrt/luci/commit/24d7da2416b9ab246825c33c213fe939a89b369cPatch
• https://github.com/x-wrt/luci/releases/tag/22.10_b202303121313Release Notes
• https://vuldb.com/?ctiid.230663Permissions Required, Third Party Advisory
• https://vuldb.com/?id.230663Permissions Required, Third Party Advisory
• https://github.com/x-wrt/luci/commit/24d7da2416b9ab246825c33c213fe939a89b369cPatch
• https://github.com/x-wrt/luci/releases/tag/22.10_b202303121313Release Notes
• https://vuldb.com/?ctiid.230663Permissions Required, Third Party Advisory
• https://vuldb.com/?id.230663Permissions Required, Third Party Advisory

Published

Jun 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30844Mutagen provides real-time file synchronization and flexible…8.8
• CVE-2023-30845ESPv2 is a service proxy that provides API management capabi…9.8
• CVE-2023-30846typed-rest-client is a library for Node Rest and Http Client…7.5
• CVE-2023-30847H2O is an HTTP server. In versions 2.3.0-beta2 and prior, wh…8.2
• CVE-2023-30848Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30849Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30850Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30851Cilium is a networking, observability, and security solution…5.3
• CVE-2023-30852Pimcore is an open source data and experience management pla…4.9
• CVE-2023-30853Gradle Build Action allows users to execute a Gradle Build i…6.5
• CVE-2023-30854AVideo is an open source video platform. Prior to version 12…8.8
• CVE-2023-30855Pimcore is an open source data and experience management pla…7.5