CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-52069
https://notcve.org/view.php?id=CVE-2023-52069
17 Jan 2024 — kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter. Se descubrió que kodbox v1.49.04 contenía una vulnerabilidad de cross site scripting (XSS) a través del parámetro URL. • https://blog.mo60.cn/index.php/archives/Kodbox_Stored_Xss_2.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-52068
https://notcve.org/view.php?id=CVE-2023-52068
16 Jan 2024 — kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs. Se descubrió que kodbox v1.43 contenía una vulnerabilidad de cross site scripting (XSS) a través de los registros de operación e inicio de sesión. • https://blog.mo60.cn/index.php/archives/Kodbox_Stored_Xss.html_Password_Kodbox_Stored_Xss1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39691
https://notcve.org/view.php?id=CVE-2023-39691
16 Jan 2024 — An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request. Un problema descubierto en kodbox hasta la versión 1.43 permite a los atacantes agregar arbitrariamente cuentas de administrador mediante una solicitud GET manipulada. • https://blog.mo60.cn/index.php/archives/kodbox_Logical.html •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-49489
https://notcve.org/view.php?id=CVE-2023-49489
19 Dec 2023 — Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php. Vulnerabilidad de Cross Site Scripting (XSS) Reflejado en KodeExplorer versión 4.51 permite a los atacantes obtener información confidencial y escalar privilegios a través del parámetro APP_HOST en config/i18n/en/main.php. • https://github.com/kalcaddle/KodExplorer/issues/526 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6853 – kalcaddle KodExplorer app.php index server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6853
16 Dec 2023 — A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugins/officeLive/app.php. The manipulation of the argument path leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6852 – kalcaddle KodExplorer app.php server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6852
16 Dec 2023 — A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6851 – kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
https://notcve.org/view.php?id=CVE-2023-6851
16 Dec 2023 — A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6850 – kalcaddle KodExplorer API Endpoint unrestricted upload
https://notcve.org/view.php?id=CVE-2023-6850
16 Dec 2023 — A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index.php?pluginApp/to/yzOffice/getFile of the component API Endpoint Handler. The manipulation of the argument path/file leads to unrestricted upload. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6849 – kalcaddle kodbox app.php cover server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6849
16 Dec 2023 — A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6848 – kalcaddle kodbox index.class.php check command injection
https://notcve.org/view.php?id=CVE-2023-6848
16 Dec 2023 — A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack can be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •