CVE-2023-28359

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-28364.8The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.CVE-2023-283604.3An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file tCVE-2023-283616.5A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidenCVE-2023-283624.0The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in thCVE-2023-283646.1An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scannedCVE-2023-283659.1A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application aCVE-2023-283667.5The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2CVE-2023-283675.4Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated aCVE-2023-283685.7TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake devCVE-2023-283693.3Brother iPrint&Scan V6.11.2 and earlier contains an improper access control vulnerability. This vulnerability may be exploited by the other CVE-2023-28375.5Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-283706.1Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrar
CVE-2023-28359: Medium severity, CVSS 5.3 | Vulnix