CVE-2023-54343 - QWE DL 2.0.1 Persistent XSS Vulnerability via Path Parameter

Back Back to CVE browser

MEDIUM

QWE DL 2.0.1 Persistent XSS Vulnerability via Path Parameter

Published Feb 1, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path parameter manipulation. Attackers can exploit the vulnerability to execute persistent cross-site scripting attacks, potentially leading to session hijacking and application module manipulation.

Affected products

Vendor QWE Labs Product Qwe DL Default
unaffected
- Version
  2.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

QWE Labs

Qwe DL

unaffected

Version	Status	Constraints
2.0.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://apps.apple.com/us/app/qwe/id935520103
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60536
Advisory
https://www.vulncheck.com/advisories/qwe-dl-persistent-xss-vulnerability-via-path-parameter
third-party-advisory
https://www.vulnerability-lab.com/get_content.php?id=2326
exploit

Link	Providers	Tags
https://apps.apple.com/us/app/qwe/id935520103		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60536		Advisory
https://www.vulncheck.com/advisories/qwe-dl-persistent-xss-vulnerability-via-path-parameter		third-party-advisory
https://www.vulnerability-lab.com/get_content.php?id=2326		exploit