CVE-2023-28701: ELITE Web Fax - SQL Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-02 · updated 2026-06-17
Weakness: CWE-89

Description

ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service.

Affected products

Elite Webfax: all versions

References

https://www.twcert.org.tw/tw/cp-132-7145-1a0d4-1.html
https://www.twcert.org.tw/tw/cp-132-7145-1a0d4-1.html

Get alerted when CVE-2023-28701 or the next vulnerability affects your stack