CVE-2023-53985

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53985
Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input parameters. Attackers can submit crafted payloads in manual insertion points to execute arbitrary JavaScript code in victim's browser context.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/leon-mbs/zstore Product
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.5.4 Exploit
https://www.exploit-db.com/exploits/51207 Exploit Third Party Advisory
https://www.vulncheck.com/advisories/zstore-reflected-cross-site-scripting-xss Third Party Advisory
https://zippy.com.ua/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:zippy:zstore:6.5.4:*:*:*:*:*:*:*
History

17 Jun 2026, 06:46

Type Values Removed Values Added
Summary
  • (es) Zstore, ahora conocido como Zippy CRM, 6.5.4 contiene una vulnerabilidad de cross-site scripting reflejado que permite a los atacantes inyectar scripts maliciosos a través de parámetros de entrada no validados. Los atacantes pueden enviar cargas útiles manipuladas en puntos de inserción manuales para ejecutar código JavaScript arbitrario en el contexto del navegador de la víctima.

27 Feb 2026, 19:53

Type Values Removed Values Added
CPE cpe:2.3:a:zippy:zstore:6.5.4:*:*:*:*:*:*:*
References () https://github.com/leon-mbs/zstore - () https://github.com/leon-mbs/zstore - Product
References () https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.5.4 - () https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.5.4 - Exploit
References () https://www.exploit-db.com/exploits/51207 - () https://www.exploit-db.com/exploits/51207 - Exploit, Third Party Advisory
References () https://www.vulncheck.com/advisories/zstore-reflected-cross-site-scripting-xss - () https://www.vulncheck.com/advisories/zstore-reflected-cross-site-scripting-xss - Third Party Advisory
References () https://zippy.com.ua/ - () https://zippy.com.ua/ - Product
First Time Zippy
Zippy zstore

13 Jan 2026, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-13 23:15

Updated : 2026-06-17 06:46

NVD link : CVE-2023-53985

Mitre link : CVE-2023-53985

CVE.ORG link : CVE-2023-53985

JSON object : View

Products Affected

zippy

  • zstore
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')