CVE Feed

    Dashboard / CVE / CVE-2023-40954

    CVE-2023-40954

    A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.

    Published:Dec 15, 2023
    Last Modified:Nov 21, 2024
    EPS:Dec 15, 2023
    EPSS Score:0.00619
    CVSS Score:9.8

    Affected Products

    Vendor
    Gmarczynski
    Product
    Dynamic Progress Bar

    Exploits

    https://github.com/luvsn/OdZoo/tree/main/exploits/web_progresshttps://github.com/luvsn/OdZoo/tree/main/exploits/web_progress

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High