CVE-2023-21709 — Microsoft Exchange_server: Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile
9.8
CVSS v3.1
100
Edit Score
Latest intel// live feed
25 results//sorted by published//last sync 2026-10-25 23:52Z
CVE-2023-3522 — A2technology License_portal_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection.This issue affects License Portal System: before 1.48. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3386 — A2technology Camera_trap_tracking_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection.This issue affects Camera Trap Tracking System: before 3.1905. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3651 — Digital-ant Digital_ant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3716 — Oduyo Online_collection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection. This issue affects Online Collection Software: before 1.0.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3717 — Farmakom Remote_administration_console: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection. This issue affects Remote Administration Console: before 1.02. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3898 — Mayanets E-commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-36095 — Langchain Langchain: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt. CVSSv3.1 9.8 (CRITICAL) · EPSS 65th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-4142 — Smackcoders Wp_ultimate_csv_importer: The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code ex CVSSv3.1 8.0 (HIGH) · EPSS 89th percentile
8.0
CVSS v3.1
91
Edit Score
CVE-2023-4141 — Smackcoders Wp_ultimate_csv_importer: The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that thi CVSSv3.1 8.0 (HIGH) · EPSS 89th percentile
8.0
CVSS v3.1
91
Edit Score
CVE-2023-38951 — Zkteco Biotime: 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM. CVSSv3.1 9.8 (CRITICAL) · EPSS 87th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-38950 — Zkteco Biotime: A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile
7.5
CVSS v3.1
100
Edit Score
Impacket 0.11.0
Impacket 0.11.0 released with significant enhancements to Kerberos handling, SMB protocol support, and example tools. Notable additions include MS-TSTS Terminal Services protocol implementation, SASL LDAP authentication, improved ntlmrelayx capabilities with DNS record registration via LDAP, and new utilities like changepasswd.py and DumpNTLMInfo.py for credential and host enumeration.
78
Edit Score
CVE-2023-37679 — Nextgen Mirth_connect: A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-38954 — Zkteco Bioaccess_ivs: BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.
ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-36255 — Eramba Eramba: An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote
An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2023-36082 — Gatesair Flexiva_fax_150w_firmware: An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to
An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials. CVSSv3.1 9.8 (CRITICAL) · EPSS 57th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-34552 — Ezviz Cs-c6n-b0-1g2wf_firmware: In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions
In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions of the SADP multicast protocol can allow an unauthenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build CVSSv3.1 8.8 (HIGH) · EPSS 37th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-34551 — Ezviz Cs-c6n-b0-1g2wf_firmware: In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ
In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware v CVSSv3.1 8.0 (HIGH) · EPSS 41th percentile
8.0
CVSS v3.1
90
Edit Score
CVE-2023-4050 — Mozilla Firefox: In some cases, an untrusted input stream was copied to a stack buffer without
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile
7.5
CVSS v3.1
91
Edit Score
CVE-2023-34960 — Chamilo Chamilo: A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-34842 — Dedecms Dedecms: Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary
Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-37647 — Sem-cms Semcms: v1.5 was discovered to contain a SQL injection vulnerability via the id parameter
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile
9.8
CVSS v3.1
99
Edit Score
An Elastic approach to large-scale dynamic malware analysis
Elastic Security Labs·elastic.co
Elastic Security Labs published a technical deep-dive on their Detonate framework and large-scale dynamic malware analysis methodology using Elasticsearch ingest pipelines. The research details how they normalize telemetry, calculate fingerprints of benign binaries, and use enrichment policies to filter out 96.83% of low-value data from 41.7M documents across 332 malware samples, enabling efficient signal extraction from noisy sandbox execution logs.
62
Edit Score
CVE-2023-38512 — Wpstream Wpstream: Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream wpstream allows Cross Site Request Forgery.This
Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream wpstream allows Cross Site Request Forgery.This issue affects WpStream: from n/a through <= 4.5.4. CVSSv3.1 8.8 (HIGH)
8.8
CVSS v3.1
94
Edit Score