Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9yny-vu36-tyes
Vulnerability ID VCID-9yny-vu36-tyes
Aliases CVE-2023-33495
GHSA-m3v5-gjj9-rg24
Summary Craft CMS through 4.4.9 is vulnerable to HTML Injection.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00168 https://api.first.org/data/v1/epss?cve=CVE-2023-33495
epss 0.00168 https://api.first.org/data/v1/epss?cve=CVE-2023-33495
epss 0.00168 https://api.first.org/data/v1/epss?cve=CVE-2023-33495
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-m3v5-gjj9-rg24
cvssv3.1 6.1 https://github.com/craftcms/cms
generic_textual MODERATE https://github.com/craftcms/cms
cvssv3.1 6.1 https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
ssvc Track https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
cvssv3.1 6.1 https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
generic_textual MODERATE https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2023-33495
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-33495
cvssv3.1 6.1 https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
generic_textual MODERATE https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
ssvc Track https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-33495
https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
https://nvd.nist.gov/vuln/detail/CVE-2023-33495
03-Testing_for_HTML_Injection https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
GHSA-m3v5-gjj9-rg24 https://github.com/advisories/GHSA-m3v5-gjj9-rg24
html-injection-in-craft-cms-application-e2b28f746212 https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/craftcms/cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/ Found at https://medium.com/%40mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-33495
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-09T21:12:01Z/ Found at https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection
Exploit Prediction Scoring System (EPSS)
Percentile 0.37785
EPSS Score 0.00168
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:27:00.518563+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/33xxx/CVE-2023-33495.json 38.6.0