CVE-2023-7210

9.8 criticalEPSS 1.0%

A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2024-01-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

onenav:onenav

References

https://note.zhaoj.in/share/eRbUygGMiJcp
https://vuldb.com/?ctiid.249765
https://vuldb.com/?id.249765
https://github.com/advisories/GHSA-353q-7h99-hf4x
https://note.zhaoj.in/share/eRbUygGMiJcp

Check your stack JSON