CVE-2023-40160

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Mar 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-401617.8Improper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user to potentially enablCVE-2023-401639.8An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially cCVE-2023-401645.5Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingSCVE-2023-401657.5rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replacCVE-2023-401665.5Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManagerCVE-2023-401675.3Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` characterCVE-2023-401686.5TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed aCVE-2023-40176.1The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameCVE-2023-401706.1jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of CVE-2023-401717.5Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens inCVE-2023-401728.8Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site requeCVE-2023-401737.5Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1
CVE-2023-40160: Low severity, CVSS 3.7 | Vulnix