NetSight
IP …
critical9.8

CVE-2023-40954

A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v.

Impact

A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.

Affected products

VendorProductAffected versions
GmarczynskiDynamic Progress Bar
from 11.0 through 11.0.2
from 12.0 through 12.0.2
from 13.0 through 13.0.2
from 14.0 through 14.0.2.1
from 15.0 through 15.0.2
from 16.0 through 16.0.2.1

Weakness classification

CWE-89

References