CVE-2023-50712

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.3.7 of iris-web. No known workarounds are available.

• CWE-79
• CWE-87

• https://github.com/dfir-iris/iris-web/releases/tag/v2.3.7Release Notes
• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-593r-747g-p92pVendor Advisory
• https://github.com/dfir-iris/iris-web/releases/tag/v2.3.7Release Notes
• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-593r-747g-p92pVendor Advisory

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50707 Through the exploitation of active user sessions, an attack…7.5
• CVE-2023-50708yii2-authclient is an extension that adds OpenID, OAuth, OAu…9.8
• CVE-2023-50709Cube is a semantic layer for building data applications. Pri…7.5
• CVE-2023-5071The Sitekit plugin for WordPress is vulnerable to Stored Cro…5.4
• CVE-2023-50710Hono is a web framework written in TypeScript. Prior to vers…4.3
• CVE-2023-50711vmm-sys-util is a collection of modules that provides helper…9.8
• CVE-2023-50713Speckle Server provides server, frontend, 3D viewer, and oth…5
• CVE-2023-50714yii2-authclient is an extension that adds OpenID, OAuth, OAu…8.8
• CVE-2023-50715Home Assistant is open source home automation software. Prio…4.3
• CVE-2023-50716eProsima Fast DDS (formerly Fast RTPS) is a C++ implementati…9.8
• CVE-2023-50717NocoDB is software for building databases as spreadsheets. S…5.4
• CVE-2023-50718NocoDB is software for building databases as spreadsheets. P…6.5