First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-0493

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
btcpayserver	btcpayserver/btcpayserver	>= unspecified, < 1.7.5

References

http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.htmlThird Party Advisory, VDB Entry
https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039aPatch
https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896fExploit, Patch, Third Party Advisory
http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.htmlThird Party Advisory, VDB Entry
https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039aPatch
https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896fExploit, Patch, Third Party Advisory

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04947.8A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSe CVE-2023-04954.3The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to m CVE-2023-04964.3The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in a CVE-2023-04974.3The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged CVE-2023-04984.3The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged CVE-2023-04994.3The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in CVE-2023-05006.5The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logge CVE-2023-05016.5The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged CVE-2023-05026.5The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in a CVE-2023-05034.3The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow CVE-2023-05044.3The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in CVE-2023-05054.3The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged