CVE-2023-40705 - Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script

Back Back to CVE browser

MEDIUM

Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script

Published Sep 5, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 0.44%

Description

Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.

Affected products

Vendor i-PRO Co., Ltd. Product VI Web Client Default
n/a
- Version
  prior to 7.9.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

i-PRO Co., Ltd.

VI Web Client

n/a

Version	Status	Constraints
prior to 7.9.6	affected	-

Remediation

No remediation recorded yet.

Metrics

0.44% 0.00441

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.00441

Score over time

2023-2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (7 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	0.44% (0.00441)	36.05th	v5 (v2026.06.15)
Jun 15, 2026	0.35% (0.00354)	27.04th	v5 (v2026.06.15)
Mar 17, 2025	0.14% (0.00144)	32.02th	v4 (v2025.03.14)
Dec 12, 2024	0.06% (0.00061)	27.87th	v3 (v2023.03.01)
Jul 10, 2024	0.05% (0.00048)	18.25th	v3 (v2023.03.01)
Apr 10, 2024	0.05% (0.00048)	16.19th	v3 (v2023.03.01)
Sep 5, 2023	0.05% (0.00047)	14.19th	v3 (v2023.03.01)