CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39691
https://notcve.org/view.php?id=CVE-2023-39691
An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request. Un problema descubierto en kodbox hasta la versión 1.43 permite a los atacantes agregar arbitrariamente cuentas de administrador mediante una solicitud GET manipulada. • https://blog.mo60.cn/index.php/archives/kodbox_Logical.html •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6849 – kalcaddle kodbox app.php cover server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6849
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c https://github.com/kalcaddle/kodbox/releases/tag/1.48.04 https://note.zhaoj.in/share/jSsPAWT1pKsq https://vuldb.com/?ctiid.248210 https://vuldb.com/?id.248210 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6848 – kalcaddle kodbox index.class.php check command injection
https://notcve.org/view.php?id=CVE-2023-6848
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack can be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c https://github.com/kalcaddle/kodbox/releases/tag/1.48.04 https://note.zhaoj.in/share/pf838kAzQyTQ https://vuldb.com/?ctiid.248209 https://vuldb.com/?id.248209 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3607 – kodbox WebConsole Plug-In webconsole.php.txt Execute os command injection
https://notcve.org/view.php?id=CVE-2023-3607
A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. • https://github.com/mohdkey/cve/blob/main/kodbox.md https://vuldb.com/?ctiid.233476 https://vuldb.com/?id.233476 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29791
https://notcve.org/view.php?id=CVE-2023-29791
kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information. • https://blog.mo60.cn/index.php/archives/kodbox-xss.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •