CVE-2023-39021
Code injection in wix-embedded-mysql
wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
- Record
CVE-2023-39021- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
- Record
CVE-2023-39021- Updated
- 2026-11-02
EUVDEUVD-2023-2051 No score
wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
- Record
EUVD-2023-2051- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fx3v-4w3w-wpwr
Code injection in wix-embedded-mysql
wix-embedded-mysql v4.6.2 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
- Record
GHSA-fx3v-4w3w-wpwr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-fx3v-4w3w-wpwr
Code injection in wix-embedded-mysql
wix-embedded-mysql v4.6.2 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
- Record
GHSA-fx3v-4w3w-wpwr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
- Record
CVE-2023-39021- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.wix:wix-embedded-mysqlMaven |
through 4.6.2 | None known |
com.wix:wix-embedded-mysqlMaven |
through 4.6.2, plus listed versions 1.0.01.0.11.0.21.0.31.1.0 Show 36 moreShow less2.0.02.0.12.0.32.0.42.0.52.0.62.0.72.1.12.1.22.1.32.1.42.1.82.1.92.2.02.2.102.2.32.2.42.2.52.2.62.2.93.0.03.0.13.0.23.1.03.1.14.0.04.0.14.1.04.1.14.1.24.1.34.2.04.4.04.5.04.6.04.6.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-39021 is a critical vulnerability (CVSS 9.8) in Wix Embedded Mysql, published July 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. No source names a fixed version.