CVE-2023-38827: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.1 Medium.
Data as of 26 Oct 2026, 07:57 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
Organizations should implement the following specific mitigations: 1) Immediately review and sanitize all user inputs and outputs related to the presentonesearchresultsform.do endpoint to ensure proper encoding and neutralization of potentially malicious scripts. 2) Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in browsers accessing the application. 3) Educate users, especially staff and students, about the risks of clicking on untrusted links or interacting with suspicious content to reduce the chance of successful social engineering. 4) Monitor web application logs for unusual or suspicious requests targeting the vulnerable endpoint to detect potential exploitation attempts. 5) Coordinate with Follett School Solutions for official patches or updates and apply them promptly once available. 6) If possible, implement web application firewalls (WAF) with rules tailored to detect and block XSS attack patterns targeting this endpoint. 7) Conduct regular security assessments and penetration tests focusing on web application input validation and output encoding to proactively identify similar vulnerabilities.
Description
Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code via presentonesearchresultsform.do.