CVE-2023-6899 MEDIUM

CVE-2023-6899: rmountjoy92 DashMachine Config save_config code injection

Vendor Rmountjoy92

Product DashMachine

Weakness CWE-94 · Code injection

Published December 17, 2023

Last update November 21, 2024

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Adjacent

Attack complexity Low

Privileges required High

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /settings/save_config of the component Config Handler. The manipulation of the argument value_template leads to code injection. The exploit has been disclosed to the public and may be used. The identifier VDB-248257 was assigned to this vulnerability.

Key dates

02Disclosure timeline

December 17, 2023 CVE published

November 21, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-6899 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities

04Related CVE

CVE-2023-4141 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution CVE-2026-42555 Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users CVE-2024-33644 WordPress Customify Site Library plugin <= 0.0.9 - Remote Code Execution (RCE) vulnerability CVE-2025-4218 handrew browserpilot gpt_selenium_agent.py GPTSeleniumAgent code injection CVE-2025-49372 WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability