{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zenario-cms-9.4.59197/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tribalsystems:zenario:9.4.59197:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.4,"id":"CVE-2023-44771"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zenario CMS (9.4.59197)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Tribalsystems"],"content_html":"\u003cp\u003eCVE-2023-44771 is a stored Cross-Site Scripting (XSS) vulnerability affecting Tribalsystems Zenario CMS version 9.4.59197. The vulnerability exists due to insufficient input sanitization within the Page Layout administration module. An attacker with low-level administrative privileges can inject arbitrary JavaScript, which executes when other users or administrators access the affected web pages.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's session. This may lead to session hijacking, unauthorized administrative actions, or defacement of the affected website.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of Tribalsystems Zenario CMS 9.4.59197.\u003c/li\u003e\n\u003cli\u003eRestrict access to the \u0026quot;Page Layout\u0026quot; administration feature to trusted administrative accounts only.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized or suspicious modifications to Page Layout templates.\u003c/li\u003e\n\u003cli\u003eCoordinate with the vendor to obtain a patch for this version, as stored XSS in administrative interfaces represents a significant risk to application integrity.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-27T08:32:04Z","date_published":"2026-10-27T08:32:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zenario-cms-xss/","summary":"An authenticated attacker can exploit a stored Cross-Site Scripting vulnerability in Tribalsystems Zenario CMS version 9.4.59197 by injecting malicious JavaScript via the Page Layout administration feature.","title":"Tribalsystems Zenario CMS: Stored Cross-Site Scripting (CVE-2023-44771)","url":"https://feed.craftedsignal.io/briefs/2026-10-zenario-cms-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Zenario CMS (9.4.59197)","version":"https://jsonfeed.org/version/1.1"}