CVE-2023-43901

HighCVSS 7.5/10Last modified Aug 28, 2026

Description

Incorrect access control in the AdHoc User creation form of eMudhra emSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by using the email address of a registered user.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://secpro.co/blog/cve-2023-43901
https://secpro.llc/EMSigner-CVE-1/Exploit, Third Party Advisory
https://secpro.llc/EMSigner-CVE-1/Exploit, Third Party Advisory

Timeline

Published: Nov 14, 2023
Last modified: Aug 28, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-439029.8Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts CVE-2023-439057.5Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.CVE-2023-439066.1Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.CVE-2023-439077.8OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.CVE-2023-439099.1Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsea CVE-2023-43925.3A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionalit CVE-2023-43936.1HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phish CVE-2023-43946.0A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw al CVE-2023-439445.4A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. It allows attackers to execute arb CVE-2023-43955.4Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.CVE-2023-439515.4SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.CVE-2023-439525.4SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.