CVE-2023-33410

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Thirukrishnan/CVE-2023-33410Exploit, Third Party Advisory
https://github.com/minical/minicalProduct
https://github.com/Thirukrishnan/CVE-2023-33410Exploit, Third Party Advisory
https://github.com/minical/minicalProduct

Timeline

Published: Jun 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-334117.5A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 CVE-2023-334128.8The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro CVE-2023-334138.8The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation CVE-2023-33429.9The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type v CVE-2023-33438.8The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization CVE-2023-334385.4A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web scri CVE-2023-334397.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.CVE-2023-33444.8The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could a CVE-2023-334407.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.CVE-2023-334439.8Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitr CVE-2023-33456.5The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possi CVE-2023-334578.8In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.