CVE-2023-41425

Medium · CVSS 6.1

Wonder CMS — Cross-Site Scripting (XSS) leading to Remote Code Execution via malicious module upload

CVSS: 6.1; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-79, CWE-79

Description

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.

Search profile — drives PoC discovery

Symbols installModuleuploadModulewondercmsprodigiousMindfc69a79629c4ba9ee88a7ad526043413installThememoduleUploadzipSVGXSS payloadfetch(document.cookie

Keywords CVE-2023-41425WonderCMS XSS RCEWonderCMS installModule exploitWonderCMS 3.2.0 3.4.2 XSSWonderCMS arbitrary code uploadWonderCMS PoCprodigiousMind WonderCMSexploit-db 52271packetstorm 190575WonderCMS module upload vulnerability

Versions: 3.2.0 through 3.4.2

Ranked PoCs (24) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

prodigiousMind/CVE-2023-41425 needs review

recent activity

gh_search · Python

★ 27
Tea-On/CVE-2023-41425-RCE-WonderCMS-4.3.2 needs review

recent activity

gh_search · Python

★ 8
duck-sec/CVE-2023-41425 needs review

gh_search · Python

★ 3
thefizzyfish/CVE-2023-41425-wonderCMS_RCE needs review

gh_search · Python

★ 2
Diegomjx/CVE-2023-41425-WonderCMS-Authenticated-RCE needs review

recent activity

gh_search · Jupyter Notebook

★ 1
Raffli-Dev/CVE-2023-41425 needs review

gh_search · Python

★ 1
charlesgargasson/CVE-2023-41425 needs review

gh_search

★ 1
xpltive/CVE-2023-41425 needs review

recent activity

gh_search · Python

★ 1
0x0d3ad/CVE-2023-41425 needs review

recent activity

gh_search · Python

★ 0
0xDTC/WonderCMS-4.3.2-XSS-to-RCE-Exploits-CVE-2023-41425 needs review

recent activity

gh_search · Shell

★ 0
KGorbakon/CVE-2023-41425 needs review

recent activity

gh_search

★ 0
PuddinCat/GithubRepoSpider needs review

trickest

★ 0
RenannLimaa/WonderCMS-3.2.0-exploit needs review

trickest

★ 0
SpycioKon/CVE-2023-41425 needs review

gh_search

★ 0
SrcVme50/Sea needs review

trickest

★ 0
TanveerS1ngh/WonderCMS-4.3.2-XSS-to-RCE-Exploits-CVE-2023-41425 needs review

trickest

★ 0
Twappz/CVE-2023-41425 needs review

gh_search

★ 0
becrevex/CVE-2023-41425 needs review

recent activity

gh_search · Lua

★ 0
charlesgargasson/charlesgargasson needs review

trickest

★ 0
dgthegeek/htb-sea needs review

trickest

★ 0
h3athen/CVE-2023-41425 needs review

gh_search · Python

★ 0
insomnia-jacob/CVE-2023-41425 needs review

trickest

★ 0
tiyeume25112004/CVE-2023-41425 needs review

trickest

★ 0
zhanpengliu-tencent/medium-cve needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T18:30:39.000Z