CVE-2023-5118

The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed.

• CWE-79
• CWE-79

• https://cert.pl/en/posts/2024/01/CVE-2023-5118/Third Party Advisory
• https://cert.pl/posts/2024/01/CVE-2023-5118/Third Party Advisory
• https://cert.pl/en/posts/2024/01/CVE-2023-5118/Third Party Advisory
• https://cert.pl/posts/2024/01/CVE-2023-5118/Third Party Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51148An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wi…8
• CVE-2023-5115An absolute path traversal attack exists in the Ansible auto…6.3
• CVE-2023-51154Jizhicms v2.5 was discovered to contain an arbitrary file do…9.8
• CVE-2023-51157Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pr…5.4
• CVE-2023-5116The Live updates from Excel plugin for WordPress is vulnerab…5.4
• CVE-2023-5117An issue was discovered in GitLab CE/EE affecting all versio…3.7
• CVE-2023-5119The Forminator WordPress plugin before 1.27.0 does not prope…4.8
• CVE-2023-51195Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-51197Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-51198Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-51199Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-5120The Migration, Backup, Staging – WPvivid plugin for WordPres…4.8