CVE-2023-3049

File Upload in TMT's Lockcell

Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. This issue affects Lockcell: before 15.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed

Vendors

Tmtmakine

Products

Lockcell Lockcell Firmware

CVE-2023-3050

Authentication Bypass in TMT's Lockcell

Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass. This issue affects Lockcell: before 15.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Tmtmakine

Products

Lockcell Lockcell Firmware

CVE-2023-35069

Path Traversal in Bullwark

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bullwark allows Path Traversal. This issue affects Bullwark: before BLW-2016E-960H.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Biges

Products

Bullwark Momentum Series

CVE-2023-35068

SQLi in BMAs Personnel Tracking System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection. This issue affects Personnel Tracking System: before 20230904.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Bma

Products

Personnel Tracking System

CVE-2023-35067

Plaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval System

Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue affects E-Invoice Approval System: before v.20230701.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Infodrom

Products

E-invoice Approval System

CVE-2026-45250

Stack buffer overflow via setcred(2)

The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs. Because the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege. Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Freebsd

Products

Freebsd

CVE-2023-35066

SQLi in Infodrom Sofwares E-Invoice Approval System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL Injection. This issue affects E-Invoice Approval System: before v.20230701.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Infodrom

Products

E-invoice Approval System

CVE-2023-35065

SQLi in Osofts Paint Production Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection. This issue affects Paint Production Management: before 2.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Osoft

Products

Dyeing - Printing - Finishing Production Management

CVE-2023-35064

SQLi in Satos Mobile

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering. This issue affects Satos Mobile: before 20230607.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Satos

Products

Satos Mobile

CVE-2023-35072

SQLi in Coyav Travels Proagent

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection. This issue affects Proagent: before 20230904 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Coyavtravel

Products

Proagent

CVE-2023-35071

SQLi in MRV Tech's Logging Administration Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection. This issue affects Logging Administration Panel: before 20230915 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mrv

Products

Logging Administration Panel

CVE-2023-35070

SQL in VegaGroup Web Collection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection. This issue affects Web Collection: before 31197.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Vegagroup

Products

Web Collection

CVE-2023-3319

XSS in iDisplays PlatPlay DS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS. This issue affects PlatPlay DS: before 3.14.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Idisplay

Products

Platplay Ds

CVE-2023-3374

Privilege Escalation in Bookreen

Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation. This issue affects Bookreen: before 3.0.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Bookreen

Products

Bookreen

CVE-2023-3375

Unrestricted File Upload in Bookreen

Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Bookreen

Products

Bookreen

CVE-2023-3376

SQLi in Digital Strategys Zekiweb

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection. This issue affects Zekiweb: before 2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dijital

Products

Zekiweb

CVE-2023-3377

SQLi in Veribilim's Veribase

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection. This issue affects Veribase: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Veribase

Products

Veribase

CVE-2023-3386

SQLi in a2 Camera Trap Tracking System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

A2technology

Products

Camera Trap Tracking System

CVE-2023-3522

SQLi in a2 License Portal System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

A2technology

Products

License Portal System

CVE-2023-3616

SQLi in Mava Softwares Hotel Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mava

Products

Hotel Management System