CVE-2023-53897

Medium · 5.4

CVSS

5.4

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

The record

Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert XSS payloads in project task comments to execute arbitrary JavaScript in victim browsers.

Affected packages

Ecosystem	Package	Introduced	Fixed