CVE-2023-1942
published 2023-04-07CVE-2023-1942: A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.89%
55.2th percentile
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/?page=user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225319.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| happyworm | jplayer | >= 0 < 2.3.0 | 2.3.0 |
| oretnom23 | online_computer_and_laptop_store | — | — |
| sourcecodester | online_computer_and_laptop_store | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8p96-wcgc-fx6f: A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1
ghsa_unreviewed·2023-04-07
CVE-2023-1942 [CRITICAL] CWE-434 GHSA-8p96-wcgc-fx6f: A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/?page=user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225319.
GHSA
jplayer Cross Site Scripting vulnerability
ghsa·2022-05-17·CVSS 4.3
CVE-2013-2022 [MEDIUM] CWE-79 jplayer Cross Site Scripting vulnerability
jplayer Cross Site Scripting vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.
No detection rules found.
No public exploits indexed.
https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Upload%20any%20file%20at%20the%20administrator%20profile%20upload%20location.pdfhttps://vuldb.com/?ctiid.225319https://vuldb.com/?id.225319https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Upload%20any%20file%20at%20the%20administrator%20profile%20upload%20location.pdfhttps://vuldb.com/?ctiid.225319https://vuldb.com/?id.225319
2023-04-07
Published