TI-2023-21490 Aliases CVE-2023-40705 GHSA-p826-jfjm-j89v

Cross-site scripting in i-PRO Co., Ltd. VI Web Client

LOW 25CWE-79Published 2023-09-05 · Updated 2024-09-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00441 38th percentileScored 2026-11-07

Fix Fixed VI Web Client (i-PRO Co., Ltd.): 7.9.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
i-PRO Co., Ltd.	VI Web Client	before 7.9.6	7.9.6	Patch available	CNA

VI Web Client Vendori-PRO Co., Ltd. Affected before 7.9.6 Fixed in 7.9.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:i-pro:video_insight::::::::	before 7.9.6	Vulnerable	i-PRO Co., Ltd.

cpe:2.3:a:i-pro:video_insight:*:*:*:*:*:*:*:* Versions before 7.9.6 Vulnerable ·i-PRO Co., Ltd.

Remediation

Fix · CNA VI Web Client (i-PRO Co., Ltd.) Fixed in 7.9.6

Timeline

2026-10-02 Threatist record created from CVE-2023-40705
2026-10-03 Alias added: GHSA-p826-jfjm-j89v

References

Advisory 1

https://jvn.jp/en/jp/JVN60140221/

Other 1

https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf

TI-2023-20833 Cross-site scripting in i-PRO Co., Ltd. VI Web Client CVSS 3.1MEDIUM 6.1
TI-2023-19949 Open redirect in i-PRO Co., Ltd. VI Web Client CVSS 3.1MEDIUM 6.1
TI-2023-21343 Cross-site scripting in i-PRO Co., Ltd. VI Web Client CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences