CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6849 – kalcaddle kodbox app.php cover server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6849
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c https://github.com/kalcaddle/kodbox/releases/tag/1.48.04 https://note.zhaoj.in/share/jSsPAWT1pKsq https://vuldb.com/?ctiid.248210 https://vuldb.com/?id.248210 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6848 – kalcaddle kodbox index.class.php check command injection
https://notcve.org/view.php?id=CVE-2023-6848
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack can be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c https://github.com/kalcaddle/kodbox/releases/tag/1.48.04 https://note.zhaoj.in/share/pf838kAzQyTQ https://vuldb.com/?ctiid.248209 https://vuldb.com/?id.248209 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45998
https://notcve.org/view.php?id=CVE-2023-45998
kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Customizing global HTML results in storing XSS. kodbox 1.44 es vulnerable a Cross Site Scripting (XSS). La personalización de HTML global da como resultado el almacenamiento de XSS. • https://gist.github.com/fangjiuye/703fdb643db558640f23e4e7c9532348 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •