CVE-2023-26217

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-262189.0The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilit CVE-2023-262198.8The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Opera CVE-2023-26224.3Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service CVE-2023-262205.4The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability th CVE-2023-262213.9The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an e CVE-2023-262225.4The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easi CVE-2023-262269.8A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 CVE-2023-26236.5The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low CVE-2023-262349.8JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.CVE-2023-262356.1JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java.CVE-2023-262367.8An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, CVE-2023-262376.7An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYST