CVE-2023-0785
LowCVSS 3.7Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
SourceCodester Best Online News Portal 1.0 contains a vulnerability in check_availability.php where manipulation of the username argument leads to exposure of sensitive information through data queries. The attack can be launched remotely, though its complexity is rather high, and a public exploit has been disclosed and may be used.
Risk Assessment
Exposure of database information can compromise the confidentiality of user and portal data. Although exploitation is difficult, the public exploit increases the likelihood of attacks.
Recommendation
Update the application to a fixed version or implement validation and parameterization of queries for the username argument. Until patched, consider restricting access to check_availability.php.
Related vulnerabilities
- CVE-2026-44267Critical
Elo prior to 1.0.1 allows plain strings passed to the parser to use the .constructor.constructor property to reach the JavaScript Function object. The resulting generated JavaScript executes attacker-selected code in the host runtime, enabling browser script execution and arbitrary Node.js code execution.
- CVE-2026-44266Critical
Elo prior to 1.0.1 has a Ruby backend that embeds attacker-controlled text in double-quoted Ruby strings without escaping #. Ruby interpolation forms in the string-literal emitter or labelled subtype-constraint branch become executable Ruby, allowing Ruby code and shell command execution.
- CVE-2026-28336Critical
SolarWinds Dameware is affected by a command injection vulnerability that could lead to compromise of the remotely controlled host. Authentication is required.
- CVE-2026-109593Critical
An unauthenticated attacker with network access to SonicWall GMS 9.5.2 and earlier may be able to read internal GMS files, potentially exposing sensitive information.
- CVE-2026-121260Critical
Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 contains a flaw in the loadstring function of usr/lib/lua/luci/controller/api/zrUsb.lua (Lua Handler component). The manipulation causes code injection and can be exploited remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.
- CVE-2026-118527MediumActively exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- CVE-2026-89292Critical
In Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0, an unauthenticated attacker could exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
- CVE-2026-4052Critical
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
- CVE-2026-13594Critical
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
- CVE-2026-120534Critical
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.
Original NVD description (English source)
A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file check_availability.php. The manipulation of the argument username leads to exposure of sensitive information through data queries. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-220645 was assigned to this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS