CVE-2023-26578: high-severity vulnerability in IDAttend Pty Ltd IDWeb
Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.6%
Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
IDAttend Pty Ltd · IDWebRelated CVEs — IDAttend Pty Ltd IDWeb
In the same product, most dangerous first.
CVE-2023-27262CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.9%CVE-2023-27255CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.9%CVE-2023-27254CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.9%CVE-2023-26572CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.9%CVE-2023-26569CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.9%CVE-2023-26568CRITICALUnauthenticated SQL Injection In IDAttend’s IDWeb ApplicationEPSS 0.9%