CVE-2023-2180

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-218007.8Windows Installer Elevation of Privilege VulnerabilityCVE-2023-218017.8Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-218027.8Windows Media Remote Code Execution VulnerabilityCVE-2023-218039.8Windows iSCSI Discovery Service Remote Code Execution VulnerabilityCVE-2023-218047.8Windows Graphics Component Elevation of Privilege VulnerabilityCVE-2023-218057.8Windows MSHTML Platform Remote Code Execution VulnerabilityCVE-2023-218068.2Power BI Report Server Spoofing VulnerabilityCVE-2023-218076.5Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityCVE-2023-218087.8.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2023-218097.8Microsoft Defender for Endpoint Security Feature Bypass VulnerabilityCVE-2023-21816.5An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A maliciousCVE-2023-218117.5Windows iSCSI Service Denial of Service Vulnerability
CVE-2023-2180: High severity, CVSS 7.5 | Vulnix