Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-at76-vmzh-sbat

Summary

Improper Control of Generation of Code ('Code Injection')
A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Management Page. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248246 is the identifier assigned to this vulnerability.

Aliases

alias	CVE-2023-6886

alias	GHSA-3x3w-849q-423v

Fixed_packages

Affected_packages

url pkg:maven/com.xnx3.wangmarket/wangmarket@6.1.0

purl pkg:maven/com.xnx3.wangmarket/wangmarket@6.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-at76-vmzh-sbat

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.xnx3.wangmarket/wangmarket@6.1.0

References

reference_url	https://github.com/xnx3/wangmarket/issues/8
reference_id
reference_type
scores
url	https://github.com/xnx3/wangmarket/issues/8

reference_url	https://vuldb.com/?ctiid.248246
reference_id
reference_type
scores
url	https://vuldb.com/?ctiid.248246

reference_url	https://vuldb.com/?id.248246
reference_id
reference_type
scores
url	https://vuldb.com/?id.248246

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-6886
reference_id	CVE-2023-6886
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-6886

reference_url	https://github.com/advisories/GHSA-3x3w-849q-423v
reference_id	GHSA-3x3w-849q-423v
reference_type
scores
url	https://github.com/advisories/GHSA-3x3w-849q-423v

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	94
name	Improper Control of Generation of Code ('Code Injection')
description	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-at76-vmzh-sbat

Vulnerability Instance