CVE-2023-33255
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application.
| Vendor | n/a |
| Product | n/a |
| Published | May 26, 2023 |
| Last Updated | Jan 15, 2025 |
Stay Ahead of the Next One
Get instant alerts for n/a n/a
Be the first to know when new medium vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n/a / n/a
n/a
References
schutzwerk.com: https://schutzwerk.com schutzwerk.com: https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt seclists.org: http://seclists.org/fulldisclosure/2023/May/21 packetstormsecurity.com: http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html schutzwerk.com: https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/