{"id":"CVE-2023-40954","aliases":["EUVD-2023-45493","GHSA-2qwv-4qw2-9pcq"],"status":"published","title":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v....","description":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00884,"percentile":0.59636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2023-12-15T00:00:00Z","modified":"2026-10-28T02:30:30Z","products":[{"vendor":"gmarczynski","product":"dynamic_progress_bar"}],"references":[{"url":"https://github.com/luvsn/OdZoo/tree/main/exploits/web_progress","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f","tags":["x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40954","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2qwv-4qw2-9pcq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40954.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-40954","description":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.","status":"published","published":"2023-12-15T00:00:00Z","modified":"2024-08-02T18:46:11.076Z","updated_at":"2026-11-02T14:35:21.612665Z"}],"euvd":[{"id":"EUVD-2023-45493","description":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.","status":"published","published":"2023-12-15T00:00:00Z","modified":"2024-08-02T18:46:11Z","updated_at":"2026-11-03T03:50:01.590469Z"}],"ghsa":[{"id":"GHSA-2qwv-4qw2-9pcq","title":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v....","description":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.","status":"published","published":"2023-12-15T03:30:17Z","modified":"2023-12-20T18:30:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:55:15.236949Z"}],"nvd":[{"id":"CVE-2023-40954","description":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.","status":"published","published":"2023-12-15T01:15:07.993Z","modified":"2026-06-17T06:20:00.37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"CVE-2023-40954","description":"A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.","status":"published","published":"2023-12-15T00:00:00Z","modified":"2026-10-28T02:30:30.479850498Z","updated_at":"2026-11-02T15:44:33.244128Z"}]}}