CVE-2023-6312

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file deleteUser.php of the component Users Page. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246138 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-63136.1A vulnerability was found in SourceCodester URL Shortener 1.0. It has been declared as problematic. Affected by this vulnerability is an unkCVE-2023-63147.8Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a speciCVE-2023-63157.8Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a sCVE-2023-63169.8The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upCVE-2023-63179.8A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged accountCVE-2023-63187.2A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS versioCVE-2023-63197.2A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS vCVE-2023-63207.2A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 andCVE-2023-63218.8A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution asCVE-2023-63228.8A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and CVE-2023-63236.5ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.CVE-2023-63248.8ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity