CVE-2023-0455

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
unilogies	unilogies/bumsys	>= unspecified, < v1.0.3-beta

References

http://packetstormsecurity.com/files/172674/Bumsys-Business-Management-System-1.0.3-beta-Shell-Upload.html
https://github.com/unilogies/bumsys/commit/a5beff7868ab63bf4ec752a1102f8da033c66b28Patch, Third Party Advisory
https://huntr.dev/bounties/b5e9c578-1a33-4745-bf6b-e7cdb89793f7Exploit, Patch, Third Party Advisory
http://packetstormsecurity.com/files/172674/Bumsys-Business-Management-System-1.0.3-beta-Shell-Upload.html
https://github.com/unilogies/bumsys/commit/a5beff7868ab63bf4ec752a1102f8da033c66b28Patch, Third Party Advisory
https://huntr.dev/bounties/b5e9c578-1a33-4745-bf6b-e7cdb89793f7Exploit, Patch, Third Party Advisory

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04567.5A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. CVE-2023-04577.5Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and CVE-2023-04584.7A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled CVE-2023-04595.5Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok CVE-2023-04607.3The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Conte CVE-2023-04617.8There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulne CVE-2023-04629.1An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operat CVE-2023-04633.3The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022 CVE-2023-04647.5A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains t CVE-2023-04655.3Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent cert CVE-2023-04665.3The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verifica CVE-2023-04674.3The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP te