CVE-2023-4868

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239353 was assigned to this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
SourceCodester	Contact Manager App	1.0
contact_manager_app_project	contact_manager_app	1.0

References

https://skypoc.wordpress.com/2023/09/05/vuln1/Exploit, Third Party Advisory
https://vuldb.com/?ctiid.239353Permissions Required, Third Party Advisory
https://vuldb.com/?id.239353Third Party Advisory
https://skypoc.wordpress.com/2023/09/05/vuln1/Exploit, Third Party Advisory
https://vuldb.com/?ctiid.239353Permissions Required, Third Party Advisory
https://vuldb.com/?id.239353Third Party Advisory

Timeline

Published: Sep 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-486805.5Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Prote CVE-2023-486816.1Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (CVE-2023-486825.4Stored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows)CVE-2023-486837.1Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect C CVE-2023-486847.1Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect C CVE-2023-486859.8Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.ph CVE-2023-486879.8Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reserva CVE-2023-486899.8Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train CVE-2023-48698.8A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknow CVE-2023-486919.8Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can caus CVE-2023-486929.8Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can caus CVE-2023-486939.8Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can