CVE-2023-3519

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Aug 5, 2026

Description

Unauthenticated remote code execution

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 19, 2023
Last modified
Aug 5, 2026
Added to CISA KEV
Jul 19, 2023
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-351916.8Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of servicCVE-2023-351927.8Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enableCVE-2023-351938.8An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A sCVE-2023-351948.8An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A sCVE-2023-35204.6Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.CVE-2023-35216.1Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.CVE-2023-35229.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL InCVE-2023-35237.1Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-35246.1The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-CVE-2023-35257.5The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' CVE-2023-35269.6In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthCVE-2023-35276.8A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with admini
CVE-2023-3519: Critical severity, CVSS 9.8 | Vulnix