CVE-2023-0947

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-09486.1The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to CVE-2023-09494.8Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.CVE-2023-09507.8Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to cCVE-2023-09518.8Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perforCVE-2023-09526.5Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive dataCVE-2023-09538.8Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker toCVE-2023-09549.8A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long periCVE-2023-09558.8The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection aCVE-2023-09567.5External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizingCVE-2023-09579.6An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability thCVE-2023-09586.5Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handCVE-2023-09596.5Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sen
CVE-2023-0947: Critical severity, CVSS 9.8 | Vulnix