CVE-2023-43986: Dmconcept Configurator

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken.

Affected products

• Dmconcept Configurator: before 4.9.4 (fixed in 4.9.4)

Published 2023-10-19. Last modified 2026-06-17.