CVE-2023-0320

XSS in UBYS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Izmir Katip Celebi University UBYS allows Stored XSS. This issue affects UBYS: before 23.03.16.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

University Information Management System Project

Products

University Information Management System

CVE-2023-0322

XSS in Talent Software UNIS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 28376.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Talentyazilim

Products

Unis

CVE-2023-0577

Multiple XSS in ASOS Information Technologies' Sobiad

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies SOBIAD allows Cross-Site Scripting (XSS). This issue affects SOBIAD: before 23.02.01.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Asosegitim

Products

Sobiad

CVE-2023-0578

Multiple XSS in ASOS Information Technologies' Book Cites

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies Book Cites allows Cross-Site Scripting (XSS). This issue affects Book Cites: before 23.01.05.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Asosegitim

Products

Bookcites

CVE-2023-0839

Improper Error Handling in inSCADA

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting. This issue affects inSCADA: before 20230115-1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Inscada Project

Products

Inscada

CVE-2023-0882

Authorization Bypass Through User-Controlled Key on Single Connect

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Krontech Microsoft

Products

Single Connect Windows

CVE-2023-0939

Multiple SQL Injection on NTN Information Technologies' Online Services software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software allows SQL Injection. This issue affects Online Services Software: before 1.17.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Online Services Project

Products

Online Services

CVE-2023-0979

SQLi in MedDataPACS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData MedDataPACS allows SQL Injection. This issue affects MedDataPACS : before 2023-03-03.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Meddatapacs

Products

Meddatapacs

CVE-2023-1013

XSS in Vira-Investing

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Virames Vira-Investing allows Cross-Site Scripting (XSS). This issue affects Vira-Investing: before 1.0.84.86.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dizayn

Products

Vira-investing

CVE-2023-1014

Information disclosure in Vira-Investing

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Virames Vira-Investing allows Account Footprinting. This issue affects Vira-Investing: before 1.0.84.86.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dizayn

Products

Vira-investing

CVE-2023-1050

SQLi in As Koc Web Report System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in As Koc Energy Web Report System allows SQL Injection. This issue affects Web Report System: before 23.03.10.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Askoc

Products

Web Report System

CVE-2023-1051

XSS in As Koc Web Report System

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in As Koc Energy Web Report System allows Reflected XSS. This issue affects Web Report System: before 23.03.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Askoc

Products

Web Report System

CVE-2023-1060

XSS in YKM CRM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YKM YKM CRM allows Reflected XSS. This issue affects YKM CRM: before 23.03.30.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ykmbilisim

Products

Ykm Crm

CVE-2026-10213

AstrBotDevs AstrBot API Endpoint delete path traversal

A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6. This vulnerability affects unknown code of the file /api/skills/delete of the component API Endpoint. Performing a manipulation of the argument Name results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Astrbot

Products

Astrbot

CVE-2023-1064

SQLi in Uzay Baskul's Weighbridge Automation Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Uzay Baskul Weighbridge Automation Software allows SQL Injection. This issue affects Weighbridge Automation Software: before 1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Uzaybaskul

Products

Weighbridge Automation Software

CVE-2023-1091

SQL Injection found in ALPATA's Licensed Warehousing Automation System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection. This issue affects Licensed Warehousing Automation System: through 2023.1.01.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Alpatateknoloji

Products

Licensed Warehousing Automation System

CVE-2023-1114

Improper Input Validation on e-Belediye

Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation. This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Eskom

Products

E-belediye

CVE-2023-1152

SQLi in Utarit Persolus

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies Persolus allows SQL Injection. This issue affects Persolus: before 2.03.93.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Utarit

Products

Persolus

CVE-2023-1153

SQLi in Pacsrapor

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Pacsrapor: before 1.22.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Pacsrapor

Products

Pacsrapor

CVE-2026-10219

nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection

A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox/fsbridge.go of the component write_file Tool. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 6.9 Medium EPSS 1.5% KEV · Not listed

Vendors

Nextlevelbuilder

Products

Goclaw