CVE-2023-3704

Timestamp Modification Vulnerability in CP-Plus Digital Video Recorder

The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the remote attacker to change system time of the targeted device.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Aditya Infotech Limited Cpplusworld

Products

Cp-uvr-0401l1-4kh Cp-uvr-0401l1b-4kh Cp-uvr-0801f1-hc and 24 more

CVE-2023-3703

Proscend Advice ICR Series routers fw version 1.76

Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Proscend

Products

A510-f1 A510-f1 Firmware A510-l1 and 38 more

CVE-2023-3701

Relative path traversal in Aqua eSolutions

Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files of the cloud disk platform, affecting the integrity and availability of the entire platform.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Aquaesolutions

Products

Aqua Drive

CVE-2023-3700

Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments

Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Easyappointments

Products

Easyappointments

CVE-2023-3699

An Improper Privilege Management vulnerability was found on the ADM

An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Asustor

Products

Data Master

CVE-2023-3698

A Command injection vulnerability was found on Printer service of ADM

Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Asustor

Products

Data Master

CVE-2023-3697

A Command injection vulnerability was found on Printer service of ADM

Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Asustor

Products

Adm Data Master

CVE-2023-3696

Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Mongoosejs

Products

Mongoose

CVE-2023-3693

SourceCodester Life Insurance Management System login.php sql injection

A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234244.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Life Insurance Management System

CVE-2023-3692

Unrestricted Upload of File with Dangerous Type in admidio/admidio

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.

CVSS 3.1 · 7.2 High EPSS 1.0% KEV · Not listed

Vendors

Admidio

Products

Admidio

CVE-2023-3691

layui HTML Attribute cross site scripting

A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Layui

Products

Layui

CVE-2023-3690

Bylancer QuickOrder GET Parameter blog sql injection

A vulnerability, which was classified as critical, has been found in Bylancer QuickOrder 6.3.7. Affected by this issue is some unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-234236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bylancer

Products

Quickorder

CVE-2023-3689

Bylancer QuickQR GET Parameter blog sql injection

A vulnerability classified as critical was found in Bylancer QuickQR 6.3.7. Affected by this vulnerability is an unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234235. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bylancer

Products

Quickqr

CVE-2023-3688

Bylancer QuickJob GET Parameter sql injection

A vulnerability classified as critical has been found in Bylancer QuickJob 6.1. Affected is an unknown function of the component GET Parameter Handler. The manipulation of the argument keywords/gender leads to sql injection. It is possible to launch the attack remotely. VDB-234234 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bylancer

Products

Quickjob

CVE-2023-3687

Bylancer QuickVCard GET Parameter blog sql injection

A vulnerability was found in Bylancer QuickVCard 2.1. It has been rated as critical. This issue affects some unknown processing of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be initiated remotely. The identifier VDB-234233 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bylancer

Products

Quickvcard

CVE-2023-3686

Bylancer QuickAI OpenAI GET Parameter blog sql injection

A vulnerability was found in Bylancer QuickAI OpenAI 3.8.1. It has been declared as critical. This vulnerability affects unknown code of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-234232. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bylancer

Products

Quickai Openai

CVE-2023-3685

Nesote Inout Search Engine AI Edition index.php cross site scripting

A vulnerability was found in Nesote Inout Search Engine AI Edition 1.1. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234231. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Nesote

Products

Inout Search Engine Ai Edition

CVE-2023-3683

LivelyWorks Articart search cross site scripting

A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_term leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Livelyworks

Products

Articart

CVE-2023-3682

Nesote Inout Blockchain EasyPayments POST Parameter getcoinaddress sql injection

A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0. Affected is an unknown function of the file /index.php/payment/getcoinaddress of the component POST Parameter Handler. The manipulation of the argument coinid leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234228. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nesote

Products

Inout Blockchain Easypayments

CVE-2023-3681

Campcodes Retro Cellphone Online Store modal_add_product.php cross site scripting

A vulnerability classified as problematic was found in Campcodes Retro Cellphone Online Store 1.0. This vulnerability affects unknown code of the file /admin/modal_add_product.php. The manipulation of the argument description leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-234226 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Retro Cellphone Online Store Project

Products

Retro Cellphone Online Store