CVE-2023-48049

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the name parameter in controllers/main.py component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/luvsn/OdZoo/tree/main/exploits/website_search_blogExploit, Third Party Advisory
https://github.com/luvsn/OdZoo/tree/main/exploits/website_search_blogExploit, Third Party Advisory

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-48055.4The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to CVE-2023-480509.8SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-atten CVE-2023-480517.5An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.CVE-2023-480527.4Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in CVE-2023-480537.5Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the di CVE-2023-480547.4Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a ma CVE-2023-480557.5SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of informati CVE-2023-480567.5PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the CVE-2023-480588.8Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run CVE-2023-48065.9A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulti CVE-2023-480608.8Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add CVE-2023-480634.3An issue was discovered in dreamer_cms 4.1.3. There is a CSRF vulnerability that can delete a theme project via /admin/category/delete.