Unknown · Subrion Cms · CVE-2023-43875
**Name of the Vulnerable Software and Affected Versions**
Subrion CMS version 4.2.1
**Description**
Multiple Cross-Site Scripting (XSS) vulnerabilities in the installation of Subrion CMS allow a local attacker to execute arbitrary web scripts via a crafted payload injected into the `dbhost`, `dbname`, `dbuser`, `adminusername`, and `adminemail`.
**Recommendations**
For Subrion CMS version 4.2.1, consider disabling the installation process until a patch is available to prevent exploitation of the XSS vulnerabilities. Restrict access to the vulnerable parameters `dbhost`, `dbname`, `dbuser`, `adminusername`, and `adminemail` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.