CVE-2023-4988

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action=uploadImg. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-239799.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-498807.5In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the mes CVE-2023-498818.8IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonat CVE-2023-498837.5IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier CVE-2023-498869.8IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java de CVE-2023-498978.8An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. I CVE-2023-498987.2In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation param CVE-2023-498999.8An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communicati CVE-2023-49907.5Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.CVE-2023-499009.8An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter comm CVE-2023-499068.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-499078.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-499088.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi