© 2026 vulntracker.io

CVE-2023-3240

OTCMS usersNews_deal.php path traversal

MEDIUM

6.5

CVSS Score

Published: June 14, 2023 at 08:31 AM UTC

Updated: June 17, 2026 at 06:13 AM UTC

1 product affected across 1 vendorOtcms

Using OTCMS by N/A?

Get instant alerts when new vulnerabilities affect OTCMS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 1.0%

SSVC

No known exploit

Description

A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

95%

v ≤ 6.626.0 6.1 6.10 6.11 6.12 6.13 6.14 6.15 6.16 6.17 6.18 6.19 6.2 6.20 6.21 6.22 6.23 6.24 6.25 6.26 6.27 6.28 6.29 6.3 6.30 6.31 6.32 6.33 6.34 6.35 6.36 6.37 6.38 6.39 6.4 6.40 6.41 6.42 6.43 6.44 6.45 6.46 6.47 6.48 6.49 6.5 6.50 6.51 6.52 6.53 6.54 6.55 6.56 6.57 6.58 6.59 6.6 6.60 6.61 6.62 6.7 6.8 6.9

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (3)

Broken LinkExploit

Source: [email protected]

https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md

SignaturePermissions RequiredThird Party Advisory

Source: [email protected]

https://vuldb.com/?ctiid.231511

VDB EntryTechnical DescriptionThird Party Advisory

Source: [email protected]

https://vuldb.com/?id.231511

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-24

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card