{"id":"CVE-2023-47261","aliases":["EUVD-2023-51392","GHSA-75vw-45w8-6h3g"],"status":"published","title":"Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted...","description":"Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01527,"percentile":0.7488,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2023-12-14T00:00:00Z","modified":"2026-06-17T06:32:30Z","products":[{"vendor":"dokmee","product":"enterprise_content_management"}],"references":[{"url":"https://www.dokmee.com/Support-Learn/Updates-Change-Log","tags":["x_transferred","Product"]},{"url":"https://h3x0s3.github.io/CVE2023~47261/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47261"},{"url":"https://github.com/advisories/GHSA-75vw-45w8-6h3g"}],"sources":{"cve":[{"id":"CVE-2023-47261","description":"Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2024-08-02T21:09:36.075Z","updated_at":"2026-11-02T14:35:13.912858Z"}],"euvd":[{"id":"EUVD-2023-51392","description":"Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2024-08-02T21:09:36Z","updated_at":"2026-11-03T03:49:57.829961Z"}],"ghsa":[{"id":"GHSA-75vw-45w8-6h3g","title":"Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted...","description":"Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.","status":"published","published":"2023-12-14T18:30:21Z","modified":"2023-12-19T18:30:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:55:14.600975Z"}],"nvd":[{"id":"CVE-2023-47261","description":"Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.","status":"published","published":"2023-12-14T17:15:07.933Z","modified":"2026-06-17T06:32:30.033Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"updated_at":"2026-11-02T14:08:54.696438Z"}]}}