CVE-2023-35808

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using crafted requests, custom PHP code can be injected and executed through the Notes module because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Jun 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-358098.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified i CVE-2023-35818.1Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket AP CVE-2023-358107.2An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has b CVE-2023-358118.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the R CVE-2023-358125.3An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 CVE-2023-358139.8Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce throug CVE-2023-358149.8DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.CVE-2023-358159.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.CVE-2023-358165.3DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.CVE-2023-358179.8DevExpress before 23.1.3 allows AsyncDownloader SSRF.CVE-2023-358186.8An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to CVE-2023-35824.3Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board