Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-4454

18
FAUCET Score

CVE-2023-4454 describes a Cross-Site Request Forgery (CSRF) vulnerability affecting wallabag prior to version 2.6.3. This medium-severity flaw (CVSS 5.7) requires user interaction and low privileges, allowing an attacker to induce authenticated users to perform unintended actions, potentially leading to high integrity impact. There is currently no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. Community discussion and media coverage for this CVE are minimal.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.6.3CPE matchmatch criteria
cpe:2.3:a:wallabag:wallabag:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

4.3MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
1.4
CvssVersion
3.0

Exploit Intelligence

EPSS Score
0.23%
Probability of exploitation in next 30 days
EPSS Percentile
14.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0023 is in the 17th percentile among its peer group of 15,224 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

composerpatch availablevia ghsa
Product: wallabag/wallabagFixed in: 2.6.3
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-p8gp-899c-jvq9medium

Wallabag user can reset data unintentionally

Aug 21, 2023

References

github.com / wallabag/wallabag/commit/78b0b55c40511e1f22d5bbb4897aa10fca68441c
Patch
huntr.dev / bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299
ExploitPatchThird Party Advisory