CVE-2023-53985CWE-79

Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)

Medium · published January 13, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input parameters. Attackers can submit crafted payloads in manual insertion points to execute arbitrary JavaScript code in victim's browser context.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-13T22:56Z
EPSS history
Timeline
  • 13 JAN 22:56Z
    Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)
    cvelistv5