CVE-2023-7149

MediumPublished

code-projects QR Code Generator cross site scripting

Published: Dec 29, 2023
Updated: Sep 9, 2024
Assigning CNA: VulDB
Evidence observed: Aug 14, 2026

Primary CVSS

6.1/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS probability estimate

0.5%

Low · next 30 days

Percentile: 42.5%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

A vulnerability was found in code-projects QR Code Generator 1.0. It has been classified as problematic. This affects an unknown part of the file /download.php?file=author.png. The manipulation of the argument file with the input "><iMg src=N onerror=alert(document.domain)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249153 was assigned to this vulnerability.

Sources

CVEsResearch
Common Vulnerabilities and Exposures

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.