CVE-2023-41364

CriticalCVSS 9.8

Published: 01/09/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

51th percentile - higher than 51% of all known CVEs

Summary

In versions of tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to data disclosure or modification.

Recommendation

It is recommended to upgrade to the latest version of the software to eliminate this vulnerability and to review and sanitize input data to prevent SQL injection.

Original NVD description (English source)

In tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.