CVE-2023-3691
layui HTML Attribute cross site scriptingA vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.
We have discovered 37 live websites that are affected by CVE-2023-3691.
Affected Software
| Product | |
| Category | UI Frameworks |
| Vulnerable Domains | 37 live websites (0.81% of Layui install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 1 versions ( 0.67% of all versions) |
Common Weakness Enumeration
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Details
- Published - Jul 16, 2023
- Updated - Oct 23, 2024
Credits
- VulDB Gitee Analyzer (tool)
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2023-3691 United States | 6 websites |
 China | 21 websites |
 Singapore | 3 websites |
 Hong Kong | 2 websites |
 Germany | 1 websites |
 Taiwan | 1 websites |
Website Distribution by TLD
Number of websites using CVE-2023-3691| .com | 29 websites |
| .cn | 5 websites |
| .com.cn | 1 websites |
| .net | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2023-3691
Top websites that are affected by CVE-2023-3691. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ******.com | China | *,***,*** | |
| ***************.com | Hong Kong | *,***,*** | |
| *****.com | China | *,***,*** | |
| ***********.com | United States | *,***,*** | |
| ***********.com | China | *,***,*** | |
| ****.com | China | *,***,*** | |
| ***.******.com | China | *,***,*** | |
| ***************.cn | China | **,***,*** | |
| **********.com | China | **,***,*** | |
| *******.cn | China | **,***,*** |
FAQ
CVE-2023-3691 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Layui
A total of 37 websites have been identified as vulnerable to CVE-2023-3691, based on global website indexing conducted by WebTechSurvey.
The Layui is affected by the CVE-2023-3691 vulnerability.
Layui versions up to and including 2.8 are vulnerable to CVE-2023-3691.