CVE-2023-48390

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Multisuns	EasyLog web+	1.13.2.8

References

https://www.twcert.org.tw/tw/cp-132-7605-2d86d-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7605-2d86d-1.htmlThird Party Advisory

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-483929.8Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote CVE-2023-483934.3Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system in CVE-2023-483948.8Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A CVE-2023-483956.5Kaifa Technology WebITR is an online attendance system, it has insufficient validation for user input within a special function. A remote at CVE-2023-483969.1Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to CVE-2023-483974.9In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informat CVE-2023-483987.5In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing b CVE-2023-483995.5In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. Th CVE-2023-48405.4The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to CVE-2023-484015.5In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to CVE-2023-484027.8In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with CVE-2023-484037.5In sms_DecodeCodedTpMsg of sms_PduCodec.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote i