CVE-2023-6768

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the admin panel without providing any credentials by simply accessing the "lp_admin.php?adminstep=" parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Dec 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-67694.6Stored XSS vulnerability in Amazing Little Poll, affecting versions 1.3 and 1.4. This vulnerability allows a remote attacker to store a maliCVE-2023-67719.8A vulnerability, which was classified as critical, has been found in SourceCodester Simple Student Attendance System 1.0. This issue affectsCVE-2023-67727.2A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstageCVE-2023-67738.8A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerabCVE-2023-67745.4A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this issue is someCVE-2023-67756.1A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been classified as problematic. This affects an unknoCVE-2023-67765.4The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Ready Function’ field in all versions up to, and CVE-2023-67776.5The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and incCVE-2023-67785.4Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0.CVE-2023-67797.5An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the sCVE-2023-67805.3An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog funCVE-2023-67815.4The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions