CVE-2023-4188
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to the exposure of sensitive data.
Recommendation
It is recommended to upgrade to version 2.16.1-git or later to mitigate this vulnerability.
Other vulnerabilities in instantsoft/icms2
See all- CVE-2023-4704Medium
In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an external control of system or configuration settings.
- CVE-2023-4655Medium
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
- CVE-2023-4654Low
In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.
- CVE-2023-4651Medium
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
- CVE-2023-4649Medium
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.
- CVE-2023-4189Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4187Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.
Original NVD description (English source)
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.