{"id":"CVE-2023-27167","aliases":["EUVD-2023-30947","GHSA-grmq-x6cq-3wxv"],"status":"published","title":"Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values...","description":"Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.07557,"percentile":0.9457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2023-03-29T00:00:00Z","modified":"2026-07-09T01:18:13Z","exploits":[{"source":"exploitdb","id":"EDB-51340","title":"Suprema BioStar 2 v2.8.16 - SQL Injection","type":"webapps","platform":"multiple","date":"2023-04-08","url":"https://www.exploit-db.com/exploits/51340"}],"products":[{"vendor":"supremainc","product":"biostar_2"}],"references":[{"url":"https://biostar2.ciklum.net/api/users/absence?search_month=1","tags":["x_transferred","Broken Link"]},{"url":"https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/","tags":["x_transferred","Permissions Required"]},{"url":"https://protey.net/threads/cve-2023-27167-suprema-biostar-2-v2-8-16-sql-injection.995/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/171523/Suprema-BioStar-2-2.8.16-SQL-Injection.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27167"},{"url":"http://suprema.com"},{"url":"https://protey.net/threads/cve-2023-27167-suprema-biostar-2-v2-8-16-sql-injection.995"},{"url":"https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4"},{"url":"https://github.com/advisories/GHSA-grmq-x6cq-3wxv"}],"sources":{"cve":[{"id":"CVE-2023-27167","description":"Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2026-07-09T00:24:35.334Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:26.261013Z"}],"euvd":[{"id":"EUVD-2023-30947","description":"Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2026-07-09T00:24:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:06.781463Z"}],"ghsa":[{"id":"GHSA-grmq-x6cq-3wxv","title":"Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values...","description":"Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.","status":"published","published":"2023-03-29T18:30:28Z","modified":"2025-05-05T18:33:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:02:07.964163Z"}],"nvd":[{"id":"CVE-2023-27167","description":"Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.","status":"published","published":"2023-03-29T17:15:07.427Z","modified":"2026-07-09T01:18:13.07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:51.883939Z"}]}}