CVE-2023-3643: Boss Mini document file inclusion

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 75.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-12 · updated 2026-06-17
Weakness: CWE-73

Description

A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.

Affected products

Boss Mini: 1.4.0-build_6221

References

https://drive.google.com/file/d/1RXmDUAjqZvWSvHUrfRerz7My6M3KX7YG/view
https://vuldb.com/?ctiid.233889
https://vuldb.com/?id.233889
https://drive.google.com/file/d/1RXmDUAjqZvWSvHUrfRerz7My6M3KX7YG/view
https://vuldb.com/?ctiid.233889
https://vuldb.com/?id.233889

Get alerted when CVE-2023-3643 or the next vulnerability affects your stack