CVE-2023-49688

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Kashipara Group	Job Portal	1.0

References

https://fluidattacks.com/advisories/pollini/Exploit, Third Party Advisory
https://www.kashipara.com/Product
https://fluidattacks.com/advisories/pollini/Exploit, Third Party Advisory
https://www.kashipara.com/Product

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-496899.8Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php CVE-2023-49696.5A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _CVE-2023-496916.7A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2023-496926.7A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NA CVE-2023-496939.8NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unaut CVE-2023-496947.8A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP CVE-2023-496956.8OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a ne CVE-2023-496997.8Memory Corruption in IMS while calling VoLTE Streamingmedia Interface CVE-2023-49704.8The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2023-497007.5Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size destination buffer if the sou CVE-2023-497019.8Memory Corruption in SIM management while USIMPhase2init CVE-2023-497066.8Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges