CVE-2023-4885

Multiple vulnerabilities in Open5GS

Man in the Middle vulnerability, which could allow an attacker to intercept VNF (Virtual Network Function) communications resulting in the exposure of sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2023-4884

Multiple vulnerabilities in Open5GS

An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2023-4883

Multiple vulnerabilities in Open5GS

Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending a specially crafted json string to the VNF (Virtual Network Function), and triggering the ogs_sbi_message_free function, which could cause a service outage.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2023-4882

Multiple vulnerabilities in Open5GS

DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_assets() function defined in the arg-log.php file, which would then execute the args-abort.c file, causing the service to crash.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2023-4879

Cross-site Scripting (XSS) - Stored in instantsoft/icms2

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Instantcms

Products

Instantcms

CVE-2023-4878

Server-Side Request Forgery (SSRF) in instantsoft/icms2

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Instantcms

Products

Instantcms

CVE-2023-4877

Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hamza417

Products

Inure

CVE-2023-4876

Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hamza417

Products

Inure

CVE-2023-4872

SourceCodester Contact Manager App add.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Contact Manager App 1.0. This issue affects some unknown processing of the file add.php. The manipulation of the argument contact/contactName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239357 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Contact Manager App Project

Products

Contact Manager App

CVE-2023-4871

SourceCodester Contact Manager App delete.php sql injection

A vulnerability classified as critical was found in SourceCodester Contact Manager App 1.0. This vulnerability affects unknown code of the file delete.php. The manipulation of the argument contact/contactName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239356.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Contact Manager App Project

Products

Contact Manager App

CVE-2023-4869

SourceCodester Contact Manager App update.php cross-site request forgery

A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239354 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Contact Manager App Project

Products

Contact Manager App

CVE-2023-4868

SourceCodester Contact Manager App add.php cross-site request forgery

A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239353 was assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Contact Manager App Project

Products

Contact Manager App

CVE-2023-4867

Xintian Smart Table Integrated Management System Added Site Page AddUpdateSites.aspx sql injection

A vulnerability was found in Xintian Smart Table Integrated Management System 5.6.9. It has been classified as critical. Affected is an unknown function of the file /SysManage/AddUpdateSites.aspx of the component Added Site Page. The manipulation of the argument TbxSiteName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239352.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xintian Smart Table Integrated Management System Project

Products

Xintian Smart Table Integrated Management System

CVE-2023-4866

SourceCodester Online Tours & Travels Management System booking.php exec sql injection

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file booking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239351.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-4865

SourceCodester Take-Note App cross-site request forgery

A vulnerability has been found in SourceCodester Take-Note App 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239350 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Take-note App Project

Products

Take-note App

CVE-2023-4864

SourceCodester Take-Note App index.php cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Take-Note App 1.0. This affects an unknown part of the file index.php. The manipulation of the argument noteContent with the input <script>alert('xss')</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239349 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Take-note App Project

Products

Take-note App

CVE-2023-4862

File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting

The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ninjateam

Products

Filester

CVE-2023-4852

IBOS OA optimize sql injection

A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/database/optimize. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239261 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-4851

IBOS OA edit&op=member sql injection

A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=dashboard/position/edit&op=member. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239260.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-4850

IBOS OA del sql injection

A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=dashboard/position/del. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239259.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos