What is CVE-2023-7303?

CVE-2023-7303 is a low-severity vulnerability in Q2apro Q2apro-On-Site-Notifications, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2025-05-07.

How severe is CVE-2023-7303?

Low severity. CVSS v3 base score is 3.5 out of 10.

RCE in Q2apro Q2apro-On-Site-Notifications

CVE-2023-7303

A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the function process_request of the file q2apro-onsitenotifications-page.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.8 is able to address this issue. The patch is named 0ca85ca02f8aceb661e9b71fd229c45d388ea5b5. It is recommended to upgrade the affected component.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (21.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.

Affected products

Q2apro Q2apro-on-site-notifications — versions 1.4.0, 1.4.1, 1.4.2

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (issue-tracking)
cna@vuldb.com (issue-tracking)
cna@vuldb.com (patch)

Frequently asked questions

What is CVE-2023-7303?: CVE-2023-7303 is a low-severity vulnerability in Q2apro Q2apro-On-Site-Notifications, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2025-05-07.
How severe is CVE-2023-7303?: Low severity. CVSS v3 base score is 3.5 out of 10.