CVE-2023-48205

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482066.1A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via theCVE-2023-482078.8Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component.CVE-2023-482086.1A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_aCVE-2023-48215.4The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensioCVE-2023-482178.8Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafteCVE-2023-482185.3The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able tCVE-2023-482196.1TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo CVE-2023-48227.2Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations,CVE-2023-482207.4Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the inCVE-2023-482218.8wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3CVE-2023-482225.4Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs usCVE-2023-482235.9fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algor
CVE-2023-48205: Medium severity, CVSS 5.3 | Vulnix