{"api_version":"1","generated_at":"2026-04-25T21:12:49+00:00","cve":"CVE-2023-1746","urls":{"html":"https://cve.report/CVE-2023-1746","api":"https://cve.report/api/cve/CVE-2023-1746.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-1746","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-1746"},"summary":{"title":"CVE-2023-1746","description":"A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0. Affected is an unknown function of the component File Upload Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-224634 is the identifier assigned to this vulnerability.","state":"PUBLIC","assigner":"cna@vuldb.com","published_at":"2023-03-30 23:15:00","updated_at":"2023-11-07 04:04:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://vuldb.com/?ctiid.224634","name":"https://vuldb.com/?ctiid.224634","refsource":"MISC","tags":[],"title":"Login required","mime":"text/html","httpstatus":"401","archivestatus":"404"},{"url":"https://vuldb.com/?id.224634","name":"https://vuldb.com/?id.224634","refsource":"MISC","tags":[],"title":"Login required","mime":"text/html","httpstatus":"401","archivestatus":"404"},{"url":"https://github.com/iteachyou-wjn/dreamer_cms/issues/11","name":"https://github.com/iteachyou-wjn/dreamer_cms/issues/11","refsource":"MISC","tags":[],"title":"Arbitrary file upload vulnerability · Issue #11 · iteachyou-wjn/dreamer_cms · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1746","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1746","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"1746","vulnerable":"1","versionEndIncluding":"3.5.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dreamer_cms_project","cpe5":"dreamer_cms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-1746","ASSIGNER":"cna@vuldb.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0. Affected is an unknown function of the component File Upload Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-224634 is the identifier assigned to this vulnerability."},{"lang":"deu","value":"Es wurde eine Schwachstelle in Dreamer CMS bis 3.5.0 gefunden. Sie wurde als problematisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf der Komponente File Upload Handler. Durch die Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross Site Scripting","cweId":"CWE-79"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"Dreamer CMS","version":{"version_data":[{"version_affected":"=","version_value":"3.0"},{"version_affected":"=","version_value":"3.1"},{"version_affected":"=","version_value":"3.2"},{"version_affected":"=","version_value":"3.3"},{"version_affected":"=","version_value":"3.4"},{"version_affected":"=","version_value":"3.5"}]}}]}}]}},"references":{"reference_data":[{"url":"https://vuldb.com/?id.224634","refsource":"MISC","name":"https://vuldb.com/?id.224634"},{"url":"https://vuldb.com/?ctiid.224634","refsource":"MISC","name":"https://vuldb.com/?ctiid.224634"},{"url":"https://github.com/iteachyou-wjn/dreamer_cms/issues/11","refsource":"MISC","name":"https://github.com/iteachyou-wjn/dreamer_cms/issues/11"}]},"credits":[{"lang":"en","value":"Xinca0 (VulDB User)"}],"impact":{"cvss":[{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"},{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"},{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N"}]}},"nvd":{"publishedDate":"2023-03-30 23:15:00","lastModifiedDate":"2023-11-07 04:04:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:dreamer_cms_project:dreamer_cms:*:*:*:*:*:*:*:*","versionEndIncluding":"3.5.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}