rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-46346 
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46347 
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method `NdkSpack::getPacks()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46348 
SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-46349 
In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `productsUpdateModel::getExportIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-27T00:00:00.000Z
CVE-2023-46350 
SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions 2.0.4 and before, allows remote attackers to escalate privileges and obtain sensitive information via the methods IdxrmanufacturerFunctions::getCornersLink, IdxrmanufacturerFunctions::getManufacturersLike and IdxrmanufacturerFunctions::getSuppliersLike.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2023-46351 
In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2023-46352 
In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer table such as name / surname / email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-46353 
In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The method TiconProduct::getTiconByProductAndTicon() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-06T00:00:00.000Z
CVE-2023-46354 
In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer/ps_address tables such as name / surname / email / phone number / full postal address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-06T00:00:00.000Z
CVE-2023-46355 
In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-27T00:00:00.000Z
CVE-2023-46356 
In the module "CSV Feeds PRO" (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts()` has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-46357 
In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motivationsaleDataModel::getProductsByIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-22T00:00:00.000Z
CVE-2023-46358 
In the module "Referral and Affiliation Program" (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can perform SQL injection. Method `ReferralByPhoneDefaultModuleFrontController::ajaxProcessCartRuleValidate` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46359 
An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2023-46360 
Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2023-46361 
Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-46362 
jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc_auto_threshold_using_hash in src/jbig2enc.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-08T00:00:00.000Z
CVE-2023-46363 
jbig2enc v0.28 was discovered to contain a SEGV via jbig2_add_page in src/jbig2enc.cc:512.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-08T00:00:00.000Z
CVE-2023-46369 
Tenda W18E V16.01.0.8(1576) contains a stack overflow vulnerability via the portMirrorMirroredPorts parameter in the formSetNetCheckTools function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-46370 
Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-46371 
TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-46373 
TP-Link TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function deviceInfoJsonToBincauses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-46374 
ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-26T00:00:00.000Z
CVE-2023-46375 
ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46376 
Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46378 
Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-46380 
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-04T00:00:00.000Z
CVE-2023-46381 
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-04T00:00:00.000Z
CVE-2023-46382 
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-04T00:00:00.000Z
CVE-2023-46383 
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-46384 
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to disclose admin password and bypass an authentication to login Loytec device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-46385 
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-46386 
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-46387 
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. This vulnerability allows remote attackers to disclose sensitive information on Loytec device data point configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-46388 
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-46389 
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. This vulnerability allows remote attackers to disclose sensitive information on LINX configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-46393 
gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46394 
A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46396 
Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46400 
KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-23T00:00:00.000Z
CVE-2023-46401 
KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-23T00:00:00.000Z
CVE-2023-46402 
git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-17T00:00:00.000Z
CVE-2023-46404 
PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-03T00:00:00.000Z
CVE-2023-46407 
FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46408 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46409 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46410 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46411 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46412 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46413 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46414 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46415 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46416 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46417 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46418 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46419 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46420 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46421 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46422 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46423 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46424 
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46426 
Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) via gf_fwrite component in at utils/os_file.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-09T00:00:00.000Z
CVE-2023-46427 
An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), and obtain sensitive information via null pointer deference in gf_dash_setup_period component in media_tools/dash_client.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-09T00:00:00.000Z
CVE-2023-46428 
An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-01T00:00:00.000Z
CVE-2023-46435 
Sourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/?p=services/view_service&id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-26T00:00:00.000Z
CVE-2023-46442 
An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T16:18:27.291Z
CVE-2023-46445 
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-46446 
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-46447 
The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-20T00:00:00.000Z
CVE-2023-46448 
Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2023-11-01T00:00:00.000Z
CVE-2023-46449 
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of another user and takeover the account via IDOR in the password change function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-26T00:00:00.000Z
CVE-2023-46450 
Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-26T00:00:00.000Z
CVE-2023-46451 
Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-46453 
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S GL-MT2500 GL-AXT1800 GL-X3000 and GL-SFT1200.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2023-46454 
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-12T00:00:00.000Z