CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-49489
https://notcve.org/view.php?id=CVE-2023-49489
Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php. Vulnerabilidad de Cross Site Scripting (XSS) Reflejado en KodeExplorer versión 4.51 permite a los atacantes obtener información confidencial y escalar privilegios a través del parámetro APP_HOST en config/i18n/en/main.php. • https://github.com/kalcaddle/KodExplorer/issues/526 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6853 – kalcaddle KodExplorer app.php index server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6853
A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugins/officeLive/app.php. The manipulation of the argument path leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01 https://note.zhaoj.in/share/oaYHbDTnPiU3 https://vuldb.com/?ctiid.248221 https://vuldb.com/?id.248221 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6852 – kalcaddle KodExplorer app.php server-side request forgery
https://notcve.org/view.php?id=CVE-2023-6852
A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01 https://note.zhaoj.in/share/P6lQNyqQn3zY https://vuldb.com/?ctiid.248220 https://vuldb.com/?id.248220 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6851 – kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
https://notcve.org/view.php?id=CVE-2023-6851
A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01 https://note.zhaoj.in/share/D44UjzoFXYfi https://vuldb.com/?ctiid.248219 https://vuldb.com/?id.248219 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6850 – kalcaddle KodExplorer API Endpoint unrestricted upload
https://notcve.org/view.php?id=CVE-2023-6850
A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index.php?pluginApp/to/yzOffice/getFile of the component API Endpoint Handler. The manipulation of the argument path/file leads to unrestricted upload. • https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01 https://note.zhaoj.in/share/L38RNzUOwOtN https://vuldb.com/?ctiid.248218 https://vuldb.com/?id.248218 • CWE-434: Unrestricted Upload of File with Dangerous Type •