CVE-2023-4392

A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component Cookie Handler. The manipulation leads to cleartext storage of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237380. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-312

• https://l6x.notion.site/PoC-Improper-Authentication-efe05964ff604beeac15f693c1e01dd6?pvs=4Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.237380Permissions Required, Third Party Advisory
• https://vuldb.com/?id.237380Third Party Advisory
• https://l6x.notion.site/PoC-Improper-Authentication-efe05964ff604beeac15f693c1e01dd6?pvs=4Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.237380Permissions Required, Third Party Advisory
• https://vuldb.com/?id.237380Third Party Advisory

Published

Aug 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43901Incorrect access control in the AdHoc User creation form of …5.9
• CVE-2023-43902Incorrect access control in the Forgot Your Password functio…9.8
• CVE-2023-43905Incorrect access control in writercms v1.1.0 allows attacker…7.5
• CVE-2023-43906Xolo CMS v0.11 was discovered to contain a reflected cross-s…6.1
• CVE-2023-43907OptiPNG v0.7.7 was discovered to contain a global buffer ove…7.8
• CVE-2023-43909Hospital Management System thru commit 4770d was discovered …9.1
• CVE-2023-4393HTML and SMTP injections on the registration page of LiquidF…6.1
• CVE-2023-4394A use-after-free flaw was found in btrfs_get_dev_args_from_p…6
• CVE-2023-43944A Stored Cross Site Scripting (XSS) vulnerability was found …5.4
• CVE-2023-4395Cross-site Scripting (XSS) - Stored in GitHub repository coc…5.4
• CVE-2023-43951SSCMS 7.2.2 was discovered to contain a cross-site scripting…5.4
• CVE-2023-43952SSCMS 7.2.2 was discovered to contain a stored cross-site sc…5.4