CVE-2023-7091

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248938 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Dreamer	CMS	4.1.3

References

https://github.com/sweatxi/BugHub/blob/main/Dreamer-CMS.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.248938Permissions Required, Third Party Advisory
https://vuldb.com/?id.248938Third Party Advisory
https://github.com/sweatxi/BugHub/blob/main/Dreamer-CMS.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.248938Permissions Required, Third Party Advisory
https://vuldb.com/?id.248938Third Party Advisory

Timeline

Published: Dec 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-70924.3A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /CVE-2023-70937.8A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown functi CVE-2023-70947.5A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is CVE-2023-70959.8A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the fu CVE-2023-70969.8A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/cru CVE-2023-70979.8A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /a CVE-2023-70985.3** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects un CVE-2023-70999.8A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affect CVE-2023-71009.8A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown funct CVE-2023-71017.8Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary co CVE-2023-71029.8Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.T CVE-2023-71039.8Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authentication Bypass. Th