{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/tribalsystems/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tribalsystems:zenario:9.4.59197:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.4,"id":"CVE-2023-44770"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zenario (9.4.59197)"],"_cs_severities":["low"],"_cs_tags":["web-application","xss","cms"],"_cs_type":"advisory","_cs_vendors":["Tribalsystems"],"content_html":"\u003cp\u003eCVE-2023-44770 is a reflected cross-site scripting (XSS) vulnerability affecting Tribalsystems Zenario CMS version 9.4.59197. The vulnerability exists due to insufficient input sanitization within the \u0026quot;Organizer - Spare alias\u0026quot; configuration field. An authenticated user can inject arbitrary JavaScript, which executes in the context of the administrative session when accessed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript within the administrative panel. This could lead to session hijacking, unauthorized administrative actions, or the modification of site content, depending on the privileges of the victim viewing the malicious alias.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit Zenario CMS instances to identify if version 9.4.59197 is in use.\u003c/li\u003e\n\u003cli\u003eApply security patches or updates provided by Tribalsystems to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to mitigate the impact of reflected XSS attacks in the administrative interface.\u003c/li\u003e\n\u003cli\u003eMonitor administrative logs for suspicious modifications to Organizer settings or aliases.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T08:40:43Z","date_published":"2026-10-25T08:40:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zenariocms-xss/","summary":"A reflected cross-site scripting (XSS) vulnerability in the Zenario CMS Organizer spare alias feature allows authenticated users to execute arbitrary JavaScript within the administrative interface.","title":"Tribalsystems Zenario CMS: Reflected XSS (CVE-2023-44770)","url":"https://feed.craftedsignal.io/briefs/2026-10-zenariocms-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Tribalsystems","version":"https://jsonfeed.org/version/1.1"}