CVE-2023-45727

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Oct 18, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 3, 2024
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-45736.5When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causinCVE-2023-457332.8Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial informatioCVE-2023-457348.8in OpenHarmony v3.2.4 and prior versions allow an adjacent attacker arbitrary code execution through out-of-bounds write.CVE-2023-457358.0A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioningCVE-2023-457367.8Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enaCVE-2023-457375.4Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GCVE-2023-45746.5When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and CVE-2023-457405.4Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is CVE-2023-457416.8VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commandsCVE-2023-457427.2An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially cCVE-2023-457437.3Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentiallyCVE-2023-457448.8A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU)