CVE-2023-37629

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php."

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/173656/Online-Piggery-Management-System-1.0-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC/tree/main/CVE-2023-37629Exploit, Third Party Advisory
https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.htmlProduct
http://packetstormsecurity.com/files/173656/Online-Piggery-Management-System-1.0-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC/tree/main/CVE-2023-37629Exploit, Third Party Advisory
https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.htmlProduct

Timeline

Published: Jul 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-37637.5A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the compon CVE-2023-376306.1Online Piggery Management System 1.0 is vulnerable to Cross Site Scripting (XSS). An unauthenticated user can POST JavaScript code to "manag CVE-2023-376359.8UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the app CVE-2023-376365.4A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or H CVE-2023-37644.3The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9 CVE-2023-376445.5SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf. Thi CVE-2023-376455.3eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.CVE-2023-376467.8An issue in the CAB file extraction function of Bitberry File Opener v23.0 allows attackers to execute a directory traversal.CVE-2023-376479.8SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.CVE-2023-376497.5Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.CVE-2023-376510.0Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.CVE-2023-376508.8A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.