CVE-2023-4837

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including creation of additional accounts with administrative privileges. This issue affects all versions of SmodBIP. SmodBIP is no longer maintained and the vulnerability will not be fixed.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jan Syski	SmodBIP	< *

References

https://cert.pl/en/posts/2023/10/CVE-2023-4837/Third Party Advisory
https://cert.pl/posts/2023/10/CVE-2023-4837/Third Party Advisory
https://smod.pl/Product
https://cert.pl/en/posts/2023/10/CVE-2023-4837/Third Party Advisory
https://cert.pl/posts/2023/10/CVE-2023-4837/Third Party Advisory
https://smod.pl/Product

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-483719.8ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can e CVE-2023-483729.8ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this CVE-2023-483737.5ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote att CVE-2023-483746.5SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low priv CVE-2023-483758.8SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access dat CVE-2023-483769.8SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type CVE-2023-483787.5Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can e CVE-2023-483795.3Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific functio CVE-2023-48385.4The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to,CVE-2023-483808.0Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A CVE-2023-483816.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthentic CVE-2023-483826.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. A