{"id":"CVE-2023-31544","details":"A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.","aliases":["GHSA-m44f-9jhg-59cr"],"modified":"2026-08-12T15:15:09.222625Z","published":"2023-05-16T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31544.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31544.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31544"},{"type":"REPORT","url":"https://github.com/alkacon/opencms-core/issues/652"},{"type":"FIX","url":"https://github.com/alkacon/opencms-core/commit/21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alkacon/opencms-core","events":[{"introduced":"bc104acc75d2277df5864da939a1f2de5fdee504"},{"fixed":"21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:alkacon:opencms:11.0:-:*:*:*:*:*:*","extracted_events":[{"introduced":"11.0-NA"},{"last_affected":"11.0-NA"}]}}],"versions":["11.0-NA","build_11_0_0"],"database_specific":{"vanir_signatures_modified":"2026-08-12T15:15:09Z","vanir_signatures":[{"source":"https://github.com/alkacon/opencms-core/commit/21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e","target":{"file":"src-gwt/org/opencms/ade/galleries/client/ui/CmsResultItemWidget.java","function":"generateTooltipHtml"},"deprecated":false,"digest":{"function_hash":"50429665448565272100370540995517851942","length":520},"id":"CVE-2023-31544-35e7becd","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["91927551225445991945862037228577807679","63589510644510606645000682509175811155","12985639700293883131514078984697374378","321412344255156343060728942899010204069","29709425315528441144474906284849667035","176218194143383261642092853321414469115","34124468324456792625486543789398795913","167988049204659269185275283547638679337","144622807873684244434351208354175467958","171982460249227650780292751700688469575","252697926200555455118742149712327222353","201650612098034476215297017149903619819","169069705265304883125399644935528488412","298412032077307482883387501341329868144","44764525019660168099488567987899443185","8972207384109697615279536948673426749","207108137154084279567484555127082245488","61922241573248349211335395071226610392"],"threshold":0.9},"id":"CVE-2023-31544-3c69bf3e","signature_type":"Line","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e","target":{"file":"src-gwt/org/opencms/ade/galleries/client/ui/CmsResultItemWidget.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31544.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}