CVE-2023-33498

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jun 7, 2023
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-33507.5A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attackCVE-2023-335077.5KramerAV VIA GO² < 4.0.1.1326 is vulnerable to Unauthenticated arbitrary file read.CVE-2023-335089.8KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).CVE-2023-335099.8KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.CVE-2023-335107.5Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.CVE-2023-335155.4SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.CVE-2023-335177.5carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System).CVE-2023-335185.3emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory pCVE-2023-33524.3The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_reCVE-2023-335245.3Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact informaCVE-2023-335286.1halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-335308.8There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web