go to Content

TWCERT/CC Taiwan Computer Emergency Response Team/Coordination Center


Ragic No-Code Database Builder - Stored XSS

TVN ID TVN-202311001
CVE ID CVE-2023-41343
CVSS 5.4 (Medium)
Affected Products No-Code Database Builder: All version before patching
Description Ragic No-Code Database Builder's file uploading function has insufficient filtering for special characters. A remote attacker with regular user privilege can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.
Solution Update to the latest version.
Credit Vickey Tsai (Acer Cyber Security)
Public Date 2023-11-03