CVE-2023-46789

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart parameter of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
Projectworlds Pvt. LimitedOnline Matrimonial Project1.0

References

Timeline

Published
Nov 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-46795.5A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/fiCVE-2023-467939.8Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'registeCVE-2023-46806.8HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryCVE-2023-468009.8Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profCVE-2023-468018.8In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for javaCVE-2023-468025.5e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded CVE-2023-468037.5An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-468047.5An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-468058.2An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to accCVE-2023-468066.7An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege tCVE-2023-468076.7An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access orCVE-2023-468089.9An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Success
CVE-2023-46789: Critical severity, CVSS 9.8 | Vulnix