CVE-2023-53938: RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters

Published Dec 18, 2025

Updated

RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute arbitrary JavaScript in victim's browser.

Affected Software

2 affected components

RockMongo RockMongo

RockMongo RockMongo=1.1.7

Event History

Dec 18, 2025

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-53938?

CVE-2023-53938 is classified as a high severity vulnerability due to its potential to allow stored cross-site scripting attacks.

How do I fix CVE-2023-53938?

To fix CVE-2023-53938, ensure that all input parameters are properly sanitized and encoded to prevent the injection of malicious scripts.

What versions of RockMongo are affected by CVE-2023-53938?

CVE-2023-53938 affects RockMongo version 1.1.7.

Who can exploit CVE-2023-53938?

Attackers can exploit CVE-2023-53938 by submitting crafted payloads in database, collection, and login parameters.

What types of attacks can be executed using CVE-2023-53938?

CVE-2023-53938 can be exploited to perform stored cross-site scripting attacks, leading to unauthorized script execution in the context of users' sessions.