Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name…

Description

Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation.

Scores

EPSS (exploitation in 30 days)

0.73% · top 46% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs
• CWE-74 (opens in a new tab)All about CWE-74 and its CVEs

Affected products

• Zoom Video Communications, Inc. · Zoom for Android

  • affected before 5.13.10

• Zoom Video Communications, Inc. · Zoom for iOS

  • affected before 5.13.10

• Zoom Video Communications, Inc. · Zoom for Linux

  • affected before 5.13.10

• Zoom Video Communications, Inc. · Zoom for macOS

  • affected before 5.13.10

• Zoom Video Communications, Inc. · Zoom for Windows

  • affected before 5.13.10

References (1)

• https://explore.zoom.us/en/trust/security/security-bulletin/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-28599](https://trackcve.app/badge/CVE-2023-28599.svg)](https://trackcve.app/cve/CVE-2023-28599)

Record last updated 2 Jan 2025, 20:02 UTC.