CVE-2023-6720: 
Python vulnerability analysis and mitigation

A stored XSS (Cross-Site Scripting) vulnerability has been identified in Repox version 2.3.7 and earlier. The vulnerability, tracked as CVE-2023-6720, was discovered by researchers from Telefónica Tech and was disclosed on December 12, 2023. The vulnerability received a CVSS v3.1 base score of 5.5, indicating medium severity (INCIBE Advisory, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue stems from the lack of proper sanitization of field elements, which allows storing specially crafted JavaScript payloads on the server. The vulnerability has the following CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L, indicating network accessibility, low attack complexity, required low privileges, and user interaction (INCIBE Advisory).

When exploited, this vulnerability allows an attacker to store malicious JavaScript payloads on the server. These payloads are then triggered when the application loads, potentially compromising user sessions and interactions with the vulnerable application (INCIBE Advisory).

As of the vulnerability disclosure, no official solution or patch has been reported for this vulnerability (INCIBE Advisory).