CVE-2023-48376

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
SmartStar SoftwareCWS Web-Basev10.25

References

Timeline

Published
Dec 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-483787.5Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can eCVE-2023-483795.3Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific functioCVE-2023-48385.4The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to,CVE-2023-483808.0Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. ACVE-2023-483816.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticCVE-2023-483826.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. ACVE-2023-483837.5NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacCVE-2023-483849.8ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated reCVE-2023-483878.8TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions.CVE-2023-483889.8Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the CVE-2023-483897.5Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can expCVE-2023-48394.8The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to
CVE-2023-48376: Critical severity, CVSS 9.8 | Vulnix