{"vulnerability": "CVE-2023-3887", "sightings": [{"uuid": "8fdddbbf-f8f2-4363-864b-a15b4e1712d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38879", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-38879.yaml", "content": "", "creation_timestamp": "2025-05-27T08:09:41.000000Z"}, {"uuid": "8262a11b-0773-46bb-a660-99c766ab7215", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38879", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lq6lkkrkoi22", "content": "", "creation_timestamp": "2025-05-27T21:02:16.090721Z"}, {"uuid": "42591d33-0d2b-4cb9-a274-9e7917112afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38875", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda57g2v2g", "content": "", "creation_timestamp": "2025-12-01T21:02:37.272293Z"}, {"uuid": "0a1c470c-3516-44c1-ab68-caf7c9c46f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38875", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-38875.yaml", "content": "", "creation_timestamp": "2025-11-28T05:14:21.000000Z"}, {"uuid": "58b90e01-bd13-4198-aff2-d05563a67aa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38870", "type": "seen", "source": "https://t.me/cibsecurity/71177", "content": "\u203c CVE-2023-38870 \u203c\n\nA SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-28T08:41:01.000000Z"}, {"uuid": "69cb030c-8e03-4f7b-8ccf-9e8804cf0c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38874", "type": "seen", "source": "https://t.me/cibsecurity/71173", "content": "\u203c CVE-2023-38874 \u203c\n\nA remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-28T07:49:40.000000Z"}, {"uuid": "41f19fee-e4fa-45c4-923d-d1812d001fe1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38873", "type": "seen", "source": "https://t.me/cibsecurity/71175", "content": "\u203c CVE-2023-38873 \u203c\n\nThe commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a \"UI redress attack\", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is \"hijacking\" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-28T07:49:42.000000Z"}, {"uuid": "8e6abf6b-5374-470e-9132-196a8d46038f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38877", "type": "seen", "source": "https://t.me/cibsecurity/71169", "content": "\u203c CVE-2023-38877 \u203c\n\nA host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-28T07:46:41.000000Z"}, {"uuid": "4da85cda-20f2-412a-98bc-d07c803d680f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38872", "type": "seen", "source": "https://t.me/cibsecurity/71171", "content": "\u203c CVE-2023-38872 \u203c\n\nAn Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-28T07:46:44.000000Z"}, {"uuid": "d9e85249-d5fd-43ba-8010-2160808691c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38871", "type": "seen", "source": "https://t.me/cibsecurity/71165", "content": "\u203c CVE-2023-38871 \u203c\n\nThe commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-28T07:46:37.000000Z"}, {"uuid": "cef6b471-036f-4024-82fd-8584b45e3e9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38876", "type": "seen", "source": "https://t.me/cibsecurity/70846", "content": "\u203c CVE-2023-38876 \u203c\n\nA reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-21T00:30:33.000000Z"}, {"uuid": "f7d52e8b-3895-4658-96b8-d49a44aa0646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38875", "type": "seen", "source": "https://t.me/cibsecurity/70841", "content": "\u203c CVE-2023-38875 \u203c\n\nA reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-21T00:30:28.000000Z"}, {"uuid": "ba7d7cce-9cf2-4999-a46b-2e469e3382a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38878", "type": "seen", "source": "https://t.me/cibsecurity/70241", "content": "\u203c CVE-2023-38878 \u203c\n\nA reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'error_description' parameters of 'oauth2.php'.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-12T02:27:23.000000Z"}, {"uuid": "1bbe986f-62c4-460b-ade9-ea089588883b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-3887", "type": "seen", "source": "https://t.me/cibsecurity/67222", "content": "\u203c CVE-2023-3887 \u203c\n\nA vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235249 was assigned to this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-25T12:28:17.000000Z"}]}