CVE-2023-40787

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-407885.3SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthoriz CVE-2023-407916.3extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a CVE-2023-407967.8Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.CVE-2023-407978.8In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authenticat CVE-2023-407988.8In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting CVE-2023-407999.8Tenda AC23 Vv16.03.07.45_cn is vulnerable to Buffer Overflow via sub_450A4C function.CVE-2023-408008.8The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulne CVE-2023-408018.8The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.CVE-2023-408026.5The get_parentControl_list_Info function does not verify the parameters entered by the user, causing a post-authentication heap overflow vul CVE-2023-408096.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.CVE-2023-408106.1OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.CVE-2023-408126.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.