CVE-2023-24720

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-247215.4A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.CVE-2023-247245.4A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficCVE-2023-247269.8Art Gallery Management System v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter on the enquiry page.CVE-2023-247288.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the CVE-2023-247298.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the CVE-2023-24734.3A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwdCVE-2023-247308.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the CVE-2023-247318.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the usCVE-2023-247328.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the uCVE-2023-247336.1PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_zCVE-2023-247349.8An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a craCVE-2023-247356.1PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers
CVE-2023-24720: Critical severity, CVSS 9.8 | Vulnix