Tribalsystems - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/tribalsystems/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 08:40:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTribalsystems Zenario CMS: Reflected XSS (CVE-2023-44770)https://feed.craftedsignal.io/briefs/2026-10-zenariocms-xss/Sun, 25 Oct 2026 08:40:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zenariocms-xss/A reflected cross-site scripting (XSS) vulnerability in the Zenario CMS Organizer spare alias feature allows authenticated users to execute arbitrary JavaScript within the administrative interface.CVE-2023-44770 is a reflected cross-site scripting (XSS) vulnerability affecting Tribalsystems Zenario CMS version 9.4.59197. The vulnerability exists due to insufficient input sanitization within the "Organizer - Spare alias" configuration field. An authenticated user can inject arbitrary JavaScript, which executes in the context of the administrative session when accessed.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the administrative panel. This could lead to session hijacking, unauthorized administrative actions, or the modification of site content, depending on the privileges of the victim viewing the malicious alias.

Recommendation

  • Audit Zenario CMS instances to identify if version 9.4.59197 is in use.
  • Apply security patches or updates provided by Tribalsystems to remediate the vulnerability.
  • Implement a Content Security Policy (CSP) to mitigate the impact of reflected XSS attacks in the administrative interface.
  • Monitor administrative logs for suspicious modifications to Organizer settings or aliases.
]]>lowadvisoryweb-applicationxsscms