CVE-2023-53882
JLex GuestBook 1.6.4 Reflected Cross-Site Scripting via URL Parameter
- State
- Published
- Severity
- 5.1 Medium
- Published
- Dec 15, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 13, 2025
Description
JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts. Attackers can craft malicious links with XSS payloads to steal session tokens or execute arbitrary JavaScript in victims' browsers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
JLex GuestBookjlexart |
|
References
- ExploitDB-51647exploit
- JLexArt Vendor Webpageproduct
- VulnCheck Advisory: JLex GuestBook 1.6.4 Reflected Cross-Site Scripting via URL Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.