CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6852 – kalcaddle KodExplorer app.php server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6852
A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01 https://note.zhaoj.in/share/P6lQNyqQn3zY https://vuldb.com/?ctiid.248220 https://vuldb.com/?id.248220 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6851 – kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
https://notcve.org/view.php?id=CVE-2023-6851
A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01 https://note.zhaoj.in/share/D44UjzoFXYfi https://vuldb.com/?ctiid.248219 https://vuldb.com/?id.248219 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6850 – kalcaddle KodExplorer API Endpoint unrestricted upload
https://notcve.org/view.php?id=CVE-2023-6850
A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index.php?pluginApp/to/yzOffice/getFile of the component API Endpoint Handler. The manipulation of the argument path/file leads to unrestricted upload. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01 https://note.zhaoj.in/share/L38RNzUOwOtN https://vuldb.com/?ctiid.248218 https://vuldb.com/?id.248218 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6849 – kalcaddle kodbox app.php cover server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6849
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c https://github.com/kalcaddle/kodbox/releases/tag/1.48.04 https://note.zhaoj.in/share/jSsPAWT1pKsq https://vuldb.com/?ctiid.248210 https://vuldb.com/?id.248210 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6848 – kalcaddle kodbox index.class.php check command injection
https://notcve.org/view.php?id=CVE-2023-6848
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack can be launched remotely. • https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c https://github.com/kalcaddle/kodbox/releases/tag/1.48.04 https://note.zhaoj.in/share/pf838kAzQyTQ https://vuldb.com/?ctiid.248209 https://vuldb.com/?id.248209 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •