CVE-2023-33409

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jun 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-33417.5The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth CVE-2023-334108.8Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists dCVE-2023-334117.5A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 CVE-2023-334128.8The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on SupermicroCVE-2023-334138.8The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementationCVE-2023-33429.9The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type vCVE-2023-33438.8The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserializationCVE-2023-334385.4A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web scriCVE-2023-334397.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.CVE-2023-33444.8The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could aCVE-2023-334407.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.CVE-2023-334439.8Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitr
CVE-2023-33409: Medium severity, CVSS 6.5 | Vulnix