CVE-2023-43640

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Sep 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-436418.8libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array accesCVE-2023-436427.5snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnCVE-2023-436436.1AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a CVE-2023-436449.8Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent CVE-2023-436455.9OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of serCVE-2023-436467.5get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 arCVE-2023-436475.4baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload featurCVE-2023-436486.5baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission datCVE-2023-436499.8baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content prevCVE-2023-43654.3Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a CVE-2023-436507.4JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to tCVE-2023-436519.9JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary comman