CVE-2023-48392

9.8 criticalEPSS 0.6%

Critical (9.8) in kaifa webitr attendance system. EPSS 0.6% chance of exploitation in the next 30 days.

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-11-01)
CWEs: CWE-321, CWE-798
Published: 2023-12-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kaifa:webitr_attendance_system

References

https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html
https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html

Check your stack JSON