{"id":"CVE-2023-46475","details":"A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.","modified":"2026-08-12T03:51:38.543786226Z","published":"2023-11-02T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46475.json"},"references":[{"type":"WEB","url":"https://github.com/elementalSec/CVE-Disclosures/blob/main/ZentaoPMS/CVE-2023-46475/CVE-2023-46475%20-%20Cross-Site%20Scripting%20%28Stored%29.md"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46475.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46475"},{"type":"PACKAGE","url":"https://github.com/easysoft/zentaopms"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/easysoft/zentaopms","events":[{"introduced":"6ecac70d85a3ee8dbe27f833c339182dee948aae"},{"last_affected":"6ecac70d85a3ee8dbe27f833c339182dee948aae"}],"database_specific":{"extracted_events":[{"introduced":"18.3"},{"last_affected":"18.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:easycorp:zentao:18.3:*:*:*:*:*:*:*"}}],"versions":["18.3","zentaopms_18.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46475.json"}}],"schema_version":"1.9.0"}