CVE-2023-40954
Critical
Description
A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGmarczynski Dynamic Progress Bar
PublishedDec 15, 2023
First seenDec 15, 2023
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gmarczynski dynamic_progress_bar | 11.0 ≤ v ≤ 11.0.2, 12.0 ≤ v ≤ 12.0.2, 13.0 ≤ v ≤ 13.0.2, 14.0 ≤ v ≤ 14.0.2.1, 15.0 ≤ v ≤ 15.0.2, 16.0 ≤ v ≤ 16.0.2.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.