CVE-2023-51350

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the header.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ujcms/ujcmsProduct
https://github.com/ujcms/ujcms/issues/7Exploit, Issue Tracking, Third Party Advisory
https://www.ujcms.com/Product
https://github.com/ujcms/ujcmsProduct
https://github.com/ujcms/ujcms/issues/7Exploit, Issue Tracking, Third Party Advisory
https://www.ujcms.com/Product

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-513539.8Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Contr CVE-2023-513548.8Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking.This issue affec CVE-2023-513558.2Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access CVE-2023-513568.8Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a CVE-2023-513575.3Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Conf CVE-2023-513588.8Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms.This issue affects Block IPs for Gravity Forms CVE-2023-513598.8Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured CVE-2023-51365.5An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit t CVE-2023-513608.8Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured CVE-2023-513614.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ginger Plugins Sticky Chat Widget: Cli CVE-2023-513625.3Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Se CVE-2023-513636.5VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product's web management page