CVE-2023-37611

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-18 · updated 2026-06-17
Weakness: CWE-79

Description

Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component.

Affected products

Neos Cms: 8.3.3

References

https://github.com/neos/neos-development-collection/pull/4812
https://rodelllemit.medium.com/stored-xss-in-neo-cms-8-3-3-9bd1cb973c5b
https://github.com/neos/neos-development-collection/pull/4812
https://rodelllemit.medium.com/stored-xss-in-neo-cms-8-3-3-9bd1cb973c5b

Get alerted when CVE-2023-37611 or the next vulnerability affects your stack