CVE-2023-49277

dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability.

• CWE-79

• https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086Patch
• https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39Vendor Advisory
• https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086Patch
• https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39Vendor Advisory

Published

Dec 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49271Hotel Management v1.0 is vulnerable to multiple authenticate…5.4
• CVE-2023-49272Hotel Management v1.0 is vulnerable to multiple authenticate…5.4
• CVE-2023-49273Umbraco is an ASP.NET content management system (CMS). Start…5.4
• CVE-2023-49274Umbraco is an ASP.NET content management system (CMS). Start…5.3
• CVE-2023-49275Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2023-49276Uptime Kuma is an open source self-hosted monitoring tool. I…6.1
• CVE-2023-49278Umbraco is an ASP.NET content management system (CMS). Start…5.3
• CVE-2023-49279Umbraco is an ASP.NET content management system (CMS). Start…5.4
• CVE-2023-4928 SQL Injection in GitHub repository instantsoft/icms2 prior …7.2
• CVE-2023-49280XWiki Change Request is an XWiki application allowing to req…6.5
• CVE-2023-49281Calendarinho is an open source calendaring application to ma…6.1
• CVE-2023-49282msgraph-sdk-php is the Microsoft Graph Library for PHP. The …5.3