CVE-2023-4531

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection.

This issue affects E-commerce Software: before 20230901 .

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Mestav Software	E-commerce Software	< 20230901

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0495
https://www.usom.gov.tr/bildirim/tr-23-0495Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-23-0495Third Party Advisory

Timeline

Published: Sep 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-453119.8fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute ar CVE-2023-453128.8In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secur CVE-2023-453155.5Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enabl CVE-2023-453168.8Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, a CVE-2023-453178.8The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the r CVE-2023-453189.8A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A speciall CVE-2023-453197.5In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported CVE-2023-45324.3An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.CVE-2023-453207.8Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to poten CVE-2023-453218.8The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol CVE-2023-453226.5libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tre CVE-2023-453239.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the router