CVE-2023-0946

CriticalCVSS 9.8/10Last modified Aug 19, 2026

Description

A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file billing/index.php?id=9. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221593 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 21, 2023
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-09479.8Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-09486.1The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to CVE-2023-09494.8Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.CVE-2023-09507.8Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to c CVE-2023-09518.8Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perfor CVE-2023-09526.5Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data CVE-2023-09538.8Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to CVE-2023-09549.8A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long peri CVE-2023-09558.8The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection a CVE-2023-09567.5External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing CVE-2023-09579.6An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability th CVE-2023-09586.5Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the hand