CVE-2023-1971

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-918

• https://tib36.github.io/2023/04/09/tpAdmin-SSRF/Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.225408Permissions Required, Third Party Advisory
• https://vuldb.com/?id.225408Third Party Advisory
• https://tib36.github.io/2023/04/09/tpAdmin-SSRF/Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.225408Permissions Required, Third Party Advisory
• https://vuldb.com/?id.225408Third Party Advisory

Published

Apr 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1965An issue has been discovered in GitLab EE affecting all vers…6.5
• CVE-2023-1966Instruments with Illumina Universal Copy Service v1.x and v2…9.8
• CVE-2023-1967Keysight N8844A Data Analytics Web Service deserializes untr…9.8
• CVE-2023-1968 Instruments with Illumina Universal Copy Service v2.x are v…7.5
• CVE-2023-1969A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-1970** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was c…7.2
• CVE-2023-1972A potential heap based buffer overflow was found in _bfd_elf…6.5
• CVE-2023-1973A flaw was found in Undertow package. Using the FormAuthenti…7.5
• CVE-2023-1974Exposure of Sensitive Information Through Metadata in GitHub…6.5
• CVE-2023-1975Insertion of Sensitive Information Into Sent Data in GitHub …6.5
• CVE-2023-1976Password Aging with Long Expiration in GitHub repository ans…8.8
• CVE-2023-1977The Booking Manager WordPress plugin before 2.0.29 does not …8.8