CVE-2023-34837

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/sahiloj/CVE-2023-34837/blob/main/README.mdExploit, Third Party Advisory
https://github.com/sahiloj/CVE-2023-34837/blob/main/README.mdExploit, Third Party Advisory

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-348385.4A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut CVE-2023-348396.8A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CVE-2023-34846.5An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before CVE-2023-348406.1angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2023-348429.8Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /de CVE-2023-348437.5Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.CVE-2023-348449.8Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.CVE-2023-348455.4Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allo CVE-2023-348499.8An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1.CVE-2023-34853.6Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access t CVE-2023-348529.8PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.CVE-2023-348537.8Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of Smc