Read the docs
TI-2023-01620 Aliases CVE-2023-1726GHSA-pp9w-rwmf-7jvx

XSS in Proliz OBS

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proliz OBS allows Stored XSS for an authenticated user. This issue affects OBS: before 23.04.01.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix Fixed OBS (Proliz): 23.04.01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProlizOBSbefore 23.04.0123.04.01Patch availableCNA
  • OBS VendorProliz Affected before 23.04.01 Fixed in 23.04.01 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:prolizyazilim:student_affairs_information_system:*:*:*:*:*:*:*:*before 23.04.01VulnerableProlizyazilim
  • cpe:2.3:a:prolizyazilim:student_affairs_information_system:*:*:*:*:*:*:*:* Versions before 23.04.01 Vulnerable ·Prolizyazilim

Remediation

  • Fix · CNA OBS (Proliz) Fixed in 23.04.01

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1726
  2. 2026-10-03 Alias added: GHSA-pp9w-rwmf-7jvx

References

Advisory 1

Other 1

  • TI-2024-07658 IDOR in Proliz Software's OBS CVSS 3.1CRITICAL 9.8
  • TI-2024-07659 Path Traversal in Proliz Software's OBS CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences