2023 CVEs (page 6)
Page 6 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-53938 | Medium | 5.4 | 2025-12-18 | RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input paramet… |
CVE-2023-53937 | High | 7.8 | 2025-12-18 | Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library… |
CVE-2023-53936 | Medium | 4.8 | 2025-12-18 | Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titl… |
CVE-2023-53935 | Medium | 5.4 | 2025-12-18 | WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attac… |
CVE-2023-53934 | High | 7.5 | 2025-12-18 | A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improp… |
CVE-2023-53738 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can… |
CVE-2023-53737 | Medium | 4.8 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. At… |
CVE-2023-53736 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Att… |
CVE-2023-53933 | High | 8.8 | 2025-12-17 | Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attack… |
CVE-2023-53932 | Medium | 5.4 | 2025-12-17 | Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation… |
CVE-2023-53931 | Medium | 6.1 | 2025-12-17 | Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to inject malicious scripts… |
CVE-2023-53930 | High | 7.5 | 2025-12-17 | ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating th… |
CVE-2023-53929 | High | 8.8 | 2025-12-17 | phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can mod… |
CVE-2023-53928 | Medium | 5.4 | 2025-12-17 | PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded Ja… |
CVE-2023-53927 | Medium | 5.4 | 2025-12-17 | PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through section… |
CVE-2023-53926 | Critical | 9.8 | 2025-12-17 | PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attacke… |
CVE-2023-53925 | Medium | 6.1 | 2025-12-17 | UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files with embedded JavaScript. Attackers can… |
CVE-2023-53924 | High | 8.8 | 2025-12-17 | UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension durin… |
CVE-2023-53923 | Critical | 9.8 | 2025-12-17 | UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController… |
CVE-2023-53922 | Critical | 9.8 | 2025-12-17 | TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious… |
CVE-2023-53921 | Critical | 9.8 | 2025-12-17 | SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory. Attackers… |
CVE-2023-53920 | Medium | 5.4 | 2025-12-17 | PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface (podcas… |
CVE-2023-53919 | Medium | 5.4 | 2025-12-17 | PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface (… |
CVE-2023-53918 | Medium | 6.1 | 2025-12-17 | PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface (episod… |
CVE-2023-53917 | Medium | 6.5 | 2025-12-17 | Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database que… |
CVE-2023-53916 | Medium | 4.6 | 2025-12-17 | Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administ… |
CVE-2023-53915 | Medium | 4.6 | 2025-12-17 | Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting HTML content int… |
CVE-2023-53914 | Critical | 9.8 | 2025-12-17 | UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserCo… |
CVE-2023-53913 | High | 8.8 | 2025-12-17 | Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can c… |
CVE-2023-53912 | Medium | 6.2 | 2025-12-17 | USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execut… |
CVE-2023-53911 | Medium | 5.4 | 2025-12-17 | Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scr… |
CVE-2023-53910 | Medium | 5.4 | 2025-12-17 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags… |
CVE-2023-53909 | Medium | 5.4 | 2025-12-17 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG… |
CVE-2023-53908 | High | 8.8 | 2025-12-17 | HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configurati… |
CVE-2023-53907 | Medium | 6.5 | 2025-12-17 | Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files… |
CVE-2023-53906 | Medium | 4.8 | 2025-12-17 | projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the cust… |
CVE-2023-53905 | High | 8.0 | 2025-12-17 | ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can cr… |
CVE-2023-53904 | Medium | 4.6 | 2025-12-17 | Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie cat… |
CVE-2023-53900 | High | 8.8 | 2025-12-16 | Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administ… |
CVE-2023-53896 | High | 7.5 | 2025-12-16 | D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attackers to download device configuration set… |
CVE-2023-53903 | Medium | 5.4 | 2025-12-16 | WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript… |
CVE-2023-53902 | Medium | 6.5 | 2025-12-16 | WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files by manipulating directory path p… |
CVE-2023-53901 | Medium | 5.4 | 2025-12-16 | WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can u… |
CVE-2023-53899 | Critical | 9.8 | 2025-12-16 | PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can… |
CVE-2023-53898 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert i… |
CVE-2023-53897 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can i… |
CVE-2023-53895 | Critical | 9.8 | 2025-12-16 | PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the conf… |
CVE-2023-53894 | Critical | 9.8 | 2025-12-16 | phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. At… |
CVE-2023-53893 | Medium | 6.5 | 2025-12-15 | Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass… |
CVE-2023-53892 | High | 7.2 | 2025-12-15 | Blackcat CMS 1.4 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the jquery plugi… |
CVE-2023-53891 | Medium | 5.4 | 2025-12-15 | Blackcat CMS 1.4 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into page content. Attackers… |
CVE-2023-53890 | Medium | 5.4 | 2025-12-15 | Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Atta… |
CVE-2023-53889 | High | 7.2 | 2025-12-15 | Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through the assets manageme… |
CVE-2023-53888 | High | 8.8 | 2025-12-15 | Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulati… |
CVE-2023-53887 | Medium | 5.4 | 2025-12-15 | Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new pages. Attackers can cr… |
CVE-2023-53886 | High | 7.5 | 2025-12-15 | Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application… |
CVE-2023-53885 | High | 7.2 | 2025-12-15 | Webutler v3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload PHP files with system command execution. Attack… |
CVE-2023-53884 | Medium | 5.4 | 2025-12-15 | Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaSc… |
CVE-2023-53883 | High | 7.2 | 2025-12-15 | Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation… |
CVE-2023-53882 | | 2025-12-15 | JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts. Attack… | |
CVE-2023-53881 | High | 8.1 | 2025-12-15 | ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a ma… |
CVE-2023-53880 | | 2025-12-15 | Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative i… | |
CVE-2023-53879 | Medium | 5.5 | 2025-12-15 | NVClient 5.0 contains a stack buffer overflow vulnerability in the user configuration contact field that allows attackers to crash the application. Attackers c… |
CVE-2023-53878 | | 2025-12-15 | Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP request handling by exploiting Content-… | |
CVE-2023-53877 | Critical | 9.8 | 2025-12-15 | Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers ca… |
CVE-2023-53876 | Medium | 5.4 | 2025-12-15 | Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. A… |
CVE-2023-53875 | High | 8.8 | 2025-12-15 | GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code throug… |
CVE-2023-53874 | Critical | 9.8 | 2025-12-15 | GOM Player 2.3.90.5360 contains a buffer overflow vulnerability in the equalizer preset name input field that allows attackers to crash the application. Attack… |
CVE-2023-53873 | | 2025-12-15 | SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can s… | |
CVE-2023-53872 | | 2025-12-15 | Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers… | |
CVE-2023-53871 | Critical | 9.8 | 2025-12-15 | Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers ca… |
CVE-2023-53870 | | 2025-12-15 | Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can… | |
CVE-2023-53869 | | 2025-12-15 | WEBIGniter 28.7.23 contains a file upload vulnerability that allows authenticated attackers to upload and execute dangerous PHP files through the media functio… | |
CVE-2023-53868 | High | 8.8 | 2025-12-15 | Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin m… |
CVE-2023-38913 | Medium | 5.3 | 2025-12-15 | SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script. |
CVE-2023-36338 | Medium | 5.3 | 2025-12-15 | Inventory Management System 1 was discovered to contain a SQL injection vulnerability. |
CVE-2023-36337 | Medium | 6.1 | 2025-12-15 | A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitra… |
CVE-2023-29144 | Low | 3.3 | 2025-12-12 | Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection. |
CVE-2023-53776 | High | 8.8 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to exploit weak session management by reusing IP-bound session ident… |
CVE-2023-53775 | Medium | 6.5 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by exploiting weak session management contr… |
CVE-2023-53741 | High | 8.1 | 2025-12-10 | Screen SFT DAB 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP address-bound sessi… |
CVE-2023-53740 | Critical | 9.8 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentia… |
CVE-2023-53774 | Critical | 9.8 | 2025-12-09 | MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. A… |
CVE-2023-53773 | Medium | 5.3 | 2025-12-09 | MiniDVBLinux 5.4 contains an unauthenticated vulnerability in the tv_action.sh script that allows remote attackers to generate live stream snapshots through th… |
CVE-2023-53772 | High | 7.5 | 2025-12-09 | MiniDVBLinux 5.4 contains an arbitrary file disclosure vulnerability that allows attackers to read sensitive system files through the 'file' GET parameter. Att… |
CVE-2023-53771 | Critical | 9.8 | 2025-12-09 | MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can… |
CVE-2023-53770 | High | 7.5 | 2025-12-09 | MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files t… |
CVE-2023-53739 | | 2025-12-09 | Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files c… | |
CVE-2023-23729 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2023-22675 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Taylor Hawkes WP Fast Cache allows Cross Site Request Forgery.This issue affects WP Fast Cache: from n/a thr… |
CVE-2023-53866 | High | 7.8 | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: Reposition and add pcm_mutex If panic_on_warn is set and compress str… |
CVE-2023-53865 | | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix warning when putting transaction with qgroups enabled after abort If we have a… | |
CVE-2023-53864 | | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable() When disabling o… | |
CVE-2023-53863 | | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps syzbot reports that some netd… | |
CVE-2023-53862 | High | 7.8 | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Syzbot found a kernel BUG in hfs_b… |
CVE-2023-53861 | | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: ext4: correct grp validation in ext4_mb_good_group Group corruption check will access mem… | |
CVE-2023-53860 | High | 7.8 | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: dm: don't attempt to queue IO under RCU protection dm looks up the table for IO based on… |
CVE-2023-53859 | | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: s390/idle: mark arch_cpu_idle() noinstr linux-next commit ("cpuidle: tracing: Warn about… | |
CVE-2023-53858 | | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error I… | |
CVE-2023-53857 | | 2025-12-09 | In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_sk_storage: Fix invalid wait context lockdep report './test_progs -t test_local_… |