Zenario CMS (9.4.59197) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zenario-cms-9.4.59197/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 08:32:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTribalsystems Zenario CMS: Stored Cross-Site Scripting (CVE-2023-44771)https://feed.craftedsignal.io/briefs/2026-10-zenario-cms-xss/Tue, 27 Oct 2026 08:32:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zenario-cms-xss/An authenticated attacker can exploit a stored Cross-Site Scripting vulnerability in Tribalsystems Zenario CMS version 9.4.59197 by injecting malicious JavaScript via the Page Layout administration feature.CVE-2023-44771 is a stored Cross-Site Scripting (XSS) vulnerability affecting Tribalsystems Zenario CMS version 9.4.59197. The vulnerability exists due to insufficient input sanitization within the Page Layout administration module. An attacker with low-level administrative privileges can inject arbitrary JavaScript, which executes when other users or administrators access the affected web pages.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's session. This may lead to session hijacking, unauthorized administrative actions, or defacement of the affected website.

Recommendation

  1. Inventory all instances of Tribalsystems Zenario CMS 9.4.59197.
  2. Restrict access to the "Page Layout" administration feature to trusted administrative accounts only.
  3. Monitor for unauthorized or suspicious modifications to Page Layout templates.
  4. Coordinate with the vendor to obtain a patch for this version, as stored XSS in administrative interfaces represents a significant risk to application integrity.
]]>lowadvisory