CVE-2023-2799

A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functionality of the file /index.php?app=main&func=passport&action=login. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229376. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-259

• https://github.com/Peanut886/Vulnerability/blob/main/imgs/2023-Guangzhou%20Xiezhong%20Software%20Technology%20Co.%2C%20LTD/2023-04-10(2).jpgBroken Link
• https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/The-default-password-vulnerability-exists-in-the-intelligent-cooperative-office-system.mdBroken Link
• https://vuldb.com/?ctiid.229376Permissions Required, Third Party Advisory
• https://vuldb.com/?id.229376Permissions Required, Third Party Advisory
• https://github.com/Peanut886/Vulnerability/blob/main/imgs/2023-Guangzhou%20Xiezhong%20Software%20Technology%20Co.%2C%20LTD/2023-04-10(2).jpgBroken Link
• https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/The-default-password-vulnerability-exists-in-the-intelligent-cooperative-office-system.mdBroken Link
• https://vuldb.com/?ctiid.229376Permissions Required, Third Party Advisory
• https://vuldb.com/?id.229376Permissions Required, Third Party Advisory

Published

May 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27984A CWE-20: Improper Input Validation vulnerability exists in …8.8
• CVE-2023-27985emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulne…7.8
• CVE-2023-27986emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulne…7.8
• CVE-2023-27987 In Apache Linkis <=1.3.1, due to the default token generate…9.1
• CVE-2023-27988The post-authentication command injection vulnerability in t…7.2
• CVE-2023-27989A buffer overflow vulnerability in the CGI program of the Zy…6.5
• CVE-2023-27990The cross-site scripting (XSS) vulnerability in Zyxel ATP se…4.8
• CVE-2023-27991The post-authentication command injection vulnerability in t…8.8
• CVE-2023-27992The pre-authentication command injection vulnerability in th…9.8
• CVE-2023-27993A relative path traversal [CWE-23] in Fortinet FortiADC vers…7.1
• CVE-2023-27995A improper neutralization of special elements used in a temp…8.8
• CVE-2023-27997A heap-based buffer overflow vulnerability [CWE-122] in Fort…9.8