CVE-2023-3791

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in IBOS OA 4.5.5 and classified as critical. Affected by this issue is the function actionExport of the file ?r=contact/default/export of the component Personal Office Address Book. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-235058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-379108.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of a CVE-2023-379116.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and pr CVE-2023-379128.8XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of CVE-2023-379138.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 CVE-2023-379148.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.W CVE-2023-379157.5OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS crashes while par CVE-2023-379167.5KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of a CVE-2023-379178.8KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing t CVE-2023-379187.5Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dap CVE-2023-379195.4Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after en CVE-2023-37926.5A vulnerability was found in Beijing Netcon NS-ASG 6.3. It has been classified as problematic. This affects an unknown part of the file /adm CVE-2023-379209.8Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of