CVE-2023-46789: critical vulnerability in Projectworlds Pvt. Limited Online Matrimonial…
Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.0%
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart parameter of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Projectworlds Pvt. Limited · Online Matrimonial ProjectRelated CVEs — Projectworlds Pvt. Limited Online Matrimonial…
In the same product, most dangerous first.
CVE-2023-46800CRITICALOnline Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 1.0%CVE-2023-46793CRITICALOnline Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 1.0%CVE-2023-46788CRITICALOnline Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 1.0%CVE-2023-46787CRITICALOnline Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 1.0%CVE-2023-46785CRITICALOnline Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 1.0%