{"id":"CVE-2023-25309","title":"Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.","summary":"Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79","CWE-79"],"vendor":"fetlife","product":"rollout-ui","affected":["rollout-ui <= 0.5"],"published":"2023-05-11","updated":"2026-07-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-25309","references":[{"url":"https://cxsecurity.com/issue/WLB-2023050012","label":"cve@mitre.org"},{"url":"https://packetstormsecurity.com/files/172185/Rollout-UI-0.5-Cross-Site-Scripting.html","label":"cve@mitre.org"},{"url":"http://fetlife.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rollout-ui.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cxsecurity.com/issue/WLB-2023050012","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://packetstormsecurity.com/files/172185/Rollout-UI-0.5-Cross-Site-Scripting.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00521,"epssPercentile":0.41708,"ingestedAt":"2026-07-04T20:57:37.125Z","slug":"CVE-2023-25309","body":"## Overview\n\nCross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.\n\n## Affected\n\n- `rollout-ui <= 0.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}