CVE-2023-37196

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the alert settings of endpoints on DCE.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Schneider Electric	StruxureWare Data Center Expert	v7.9.3 and earlier
schneider-electric	struxureware_data_center_expert	<= 7.9.3

References

Timeline

Published: Jul 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-371978.8A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could CVE-2023-371987.2A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admi CVE-2023-371997.2A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admi CVE-2023-37206.5The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make log CVE-2023-372005.5A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacin CVE-2023-372018.8An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox CVE-2023-372028.8Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment CVE-2023-372037.8Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users int CVE-2023-372046.5A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational funct CVE-2023-372056.5The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox < 115.CVE-2023-372066.5Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. T CVE-2023-372076.5A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL.