{"action":"Upgrade craftcms/cms to 3.7.64 or later.","affected":[{"fixed":"4.3.7","introduced":"4.0.0-RC1"},{"fixed":"3.7.64","introduced":"3.7.24"}],"component":"craftcms/cms","cve_ids":["CVE-2023-23927"],"ecosystem":"Packagist","epss":0.00801,"exploited":false,"fixed_versions":["4.3.7","3.7.64"],"ghsa_id":"GHSA-qcrj-6ffc-v7hq","id":"tcs_01M5KF77HWM0MB5CBMQBE3TJCQ","modified_at":"2026-09-10T03:49:53.092413632Z","published_at":"2023-03-03T22:45:50Z","references":["https://osv.dev/vulnerability/GHSA-qcrj-6ffc-v7hq","https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq","https://nvd.nist.gov/vuln/detail/CVE-2023-23927","https://github.com/craftcms/cms","https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03","https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-qcrj-6ffc-v7hq","url":"https://osv.dev/vulnerability/GHSA-qcrj-6ffc-v7hq"}],"summary":"Craft CMS Stored Cross-site Scripting Injection Vulnerability"}