Medium severity · published Jun 26, 2023
CVE-2023-28485
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of…
5.4
CVSS
1%
EPSS
No
On KEV
Description
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Wekan · Wekan Project
before 6.75 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28485
Exploit
http://packetstormsecurity.com/files/172649/Wekan-6.74-Cross-Site-Scripting.html
Product
https://wekan.github.io/
Exploit
https://wekan.github.io/hall-of-fame/filebleed/
More from Wekan
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.8
CVE-2026-1963
WeKan Attachment Storage attachments.js MoveStorageBleed access control
9.8
CVE-2026-1962
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
8.8
CVE-2026-2206
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
8.8
CVE-2026-25859
WeKan < 8.20 Migration Functionality Insufficient Permission Checks