CVE-2023-48381

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-483826.5Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. A CVE-2023-483837.5NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attac CVE-2023-483849.8ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated re CVE-2023-483878.8TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions.CVE-2023-483889.8Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the CVE-2023-483897.5Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exp CVE-2023-48394.8The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to CVE-2023-483909.8Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code CVE-2023-483929.8Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote CVE-2023-483934.3Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system in CVE-2023-483948.8Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A CVE-2023-483956.5Kaifa Technology WebITR is an online attendance system, it has insufficient validation for user input within a special function. A remote at