CVE-2023-26770

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
n/an/an/a
taskcafe_projecttaskcafe0.3.2

References

Timeline

Published
Oct 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-267716.5Taskcafe 0.3.2 is vulnerable to Cross Site Scripting (XSS). There is a lack of validation in the filetype when uploading a SVG profile pictuCVE-2023-267736.1Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the producCVE-2023-267747.5An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of CVE-2023-267757.8File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the asseCVE-2023-267766.1Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of tCVE-2023-267776.1Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commandCVE-2023-267799.8CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).CVE-2023-26785.4A vulnerability has been found in SourceCodester File Tracker Manager System 1.0 and classified as problematic. This vulnerability affects uCVE-2023-267809.8CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection.CVE-2023-267819.8SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.CVE-2023-267826.5An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System ConfiguratCVE-2023-267849.8SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?co
CVE-2023-26770: Critical severity, CVSS 9.8 | Vulnix