CVE-2023-3705

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.

Successful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-370579.8An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentCVE-2023-370589.8Insecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to escalate privileges vCVE-2023-37064.3The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowingCVE-2023-370614.8Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section.CVE-2023-370624.8Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition.CVE-2023-370634.8Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section.CVE-2023-370644.8Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section.CVE-2023-370654.8Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section.CVE-2023-370664.8Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.CVE-2023-370674.8Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section.CVE-2023-370689.8Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthorizCVE-2023-370699.8Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate th