4.8

CVE-2023-28651: contec co., ltd. conprosys hmi system (chs) Cross-site Scripting

CVSS: 4.8v3.1MediumModified
Published 01-06-2023Last modified 09-01-2025
Open JSON

Vulnerability summary

CVE-2023-28651 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in contec co., ltd. conprosys hmi system (chs). EPSS estimates a 62.42% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
4.8/10
010
Medium · v3.1 (CVE.org)
EPSS score
62.42%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 01-06-2023
    PublishedVulnerability first disclosed.
  2. 09-01-2025
    Last modifiedVulnerability information updated.

Description

Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

62.42%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 62.42% on 21-09-2026

21-09-202621-10-2026
EPSS score
62.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Contec1 product
Contec co., ltd.1 product

2 vendors · 2 products

References

3 links