Dashboard / CVE-2023-29154

CVE-2023-29154

HIGH
HIGH Priority: 2.98 BB Relevance: 68/100
Published: 2023-06-01 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: High
A: High

Description

SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
contec conprosys_hmi_system < 3.5.3
contec conprosys_hmi_system < 3.5.3

References & Advisories (3)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

41.44%
Raw Score 0.414430
Percentile 98.7%
Date 2026-10-28

Intelligence Sources

nvd ref →

External Links