RCE in Q2apro Q2apro-On-Site-Notifications
CVE-2023-7303
A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the function process_request of the file q2apro-onsitenotifications-page.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.8 is able to address this issue. The patch is named 0ca85ca02f8aceb661e9b71fd229c45d388ea5b5. It is recommended to upgrade the affected component.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (23.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 23.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Q2apro Q2apro-On-Site-Notifications — versions 1.4.0, 1.4.1, 1.4.2
Weakness classification (CWE)
References
- vuldb.com/ (technical-description, vdb-entry)
- vuldb.com/ (signature, permissions-required)
- vuldb.com/ (third-party-advisory)
- github.com/q2apro/q2apro-on-site-notifications/issues/43 (issue-tracking)
- github.com/q2apro/q2apro-on-site-notifications/issues/43 (issue-tracking)
- github.com/q2apro/q2apro-on-site-notifications/commit/0ca85ca02f8aceb661e9b71fd… (patch)
Frequently asked questions
- What is CVE-2023-7303?
- CVE-2023-7303 is a low-severity vulnerability in Q2apro Q2apro-On-Site-Notifications, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2025-05-07.
- How severe is CVE-2023-7303?
- Low severity. CVSS v3 base score is 3.5 out of 10.