Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nk88-qzd2-x7hv
Vulnerability ID VCID-nk88-qzd2-x7hv
Aliases CVE-2023-40281
Summary EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00484 https://api.first.org/data/v1/epss?cve=CVE-2023-40281
epss 0.00484 https://api.first.org/data/v1/epss?cve=CVE-2023-40281
epss 0.00489 https://api.first.org/data/v1/epss?cve=CVE-2023-40281
ssvc Track https://jvn.jp/en/jp/JVN46993816/
ssvc Track https://www.ec-cube.net/info/weakness/20230727/
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-40281
20230727 https://www.ec-cube.net/info/weakness/20230727/
CVE-2023-40281 https://nvd.nist.gov/vuln/detail/CVE-2023-40281
JVN46993816 https://jvn.jp/en/jp/JVN46993816/
No exploits are available.
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-08T17:32:20Z/ Found at https://jvn.jp/en/jp/JVN46993816/
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-08T17:32:20Z/ Found at https://www.ec-cube.net/info/weakness/20230727/
Exploit Prediction Scoring System (EPSS)
Percentile 0.65731
EPSS Score 0.00484
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:29:43.295754+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/40xxx/CVE-2023-40281.json 38.6.0