CVE-2023-40922

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initContent().

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://security.friendsofpresta.org/modules/2023/11/02/kerawen.htmlPatch, Third Party Advisory
https://security.friendsofpresta.org/modules/2023/11/02/kerawen.htmlPatch, Third Party Advisory

Timeline

Published: Nov 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-409238.8MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_s CVE-2023-409247.5SolarView Compact < 6.00 is vulnerable to Directory Traversal.CVE-2023-40936.1Reflected and persistent XSS vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an a CVE-2023-409306.8An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mn CVE-2023-409316.5A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrar CVE-2023-409325.4A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom lo CVE-2023-409338.8A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privilege CVE-2023-409347.2A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the CVE-2023-40948.2ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block e CVE-2023-409429.8Tenda AC9 V3.0BR_V15.03.06.42_multi_TD01 was discovered stack overflow via parameter 'firewall_value' at url /goform/SetFirewallCfg.CVE-2023-409449.8Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at ~\header.php.CVE-2023-409459.8Sourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails.php.