OMICARD EDM 's SMS vulnerabilities

3 known vulnerabilities in OMICARD EDM 's SMS from ITPison. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  OMICARD EDM 's SMS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2023-48373Dec 15, 2023ITPisonEPSS 1.31%

  ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.

• 9.8 Critical severity

  OMICARD EDM 's SMS: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-48372Dec 15, 2023ITPisonEPSS 1.06%

  ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.

• 9.8 Critical severity

  OMICARD EDM 's SMS: Unrestricted Upload of File with Dangerous Type

  CVE-2023-48371Dec 15, 2023ITPison

  ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt s