CVE-2023-48380

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-483816.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthentic CVE-2023-483826.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. A CVE-2023-483837.5NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attac CVE-2023-483849.8ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated re CVE-2023-483878.8TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions.CVE-2023-483889.8Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the CVE-2023-483897.5Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exp CVE-2023-48394.8The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to CVE-2023-483909.8Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code CVE-2023-483929.8Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote CVE-2023-483934.3Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system in CVE-2023-483948.8Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A