CVE-2023-48373

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-483746.5SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low priv CVE-2023-483758.8SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access dat CVE-2023-483769.8SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type CVE-2023-483787.5Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can e CVE-2023-483795.3Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific functio CVE-2023-48385.4The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to,CVE-2023-483808.0Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A CVE-2023-483816.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthentic CVE-2023-483826.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. A CVE-2023-483837.5NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attac CVE-2023-483849.8ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated re CVE-2023-483878.8TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions.