{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-17T07:11:35.532","vulnerabilities":[{"cve":{"id":"CVE-2023-46865","sourceIdentifier":"cve@mitre.org","published":"2023-10-30T01:15:21.967","lastModified":"2026-06-17T06:31:47.203","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image."},{"lang":"es","value":"/api/v1/company/upload-logo en CompanyController.php en crater hasta 6.0.6 permite a un superadministrador ejecutar código PHP arbitrario colocando este código en un fragmento IDAT image/png de una imagen del Logotipo de la Empresa."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craterapp:crater:*:*:*:*:*:*:*:*","versionEndIncluding":"6.0.6","matchCriteriaId":"3D402EFB-A3FF-49C9-81E8-EF904A46277E"}]}]}],"references":[{"url":"https://github.com/asylumdx/Crater-CVE-2023-46865-RCE","source":"cve@mitre.org"},{"url":"https://github.com/crater-invoice/crater/issues/1267","source":"cve@mitre.org","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/crater-invoice/crater/pull/1271","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://notes.netbytesec.com/2023/11/post-auth-rce-in-crater-invoice.html","source":"cve@mitre.org"},{"url":"https://github.com/asylumdx/Crater-CVE-2023-46865-RCE","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/crater-invoice/crater/issues/1267","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/crater-invoice/crater/pull/1271","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"]},{"url":"https://notes.netbytesec.com/2023/11/post-auth-rce-in-crater-invoice.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}