CVE-2023-0331

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-03329.8A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown func CVE-2023-03335.4The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an CVE-2023-03346.1The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page,CVE-2023-03356.5The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscri CVE-2023-03366.5The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with ro CVE-2023-03376.1Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.CVE-2023-03386.1Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.CVE-2023-03399.8Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Acces CVE-2023-03408.8The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a CVE-2023-03417.8A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write CVE-2023-03425.3MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files t CVE-2023-03437.5Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an