2023 CVEs (page 6)
Page 6 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-53986 | High | 8.6 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: disable RAC flush for TP1 RAC flush causes kernel panics on BCM6358… |
CVE-2023-53867 | Critical | 9.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just… |
CVE-2023-53982 | High | 7.5 | 2025-12-23 | PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries… |
CVE-2023-52210 | Medium | 5.3 | 2025-12-23 | Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through… |
CVE-2023-53981 | High | 7.2 | 2025-12-22 | PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through the exiftran path co… |
CVE-2023-53980 | Critical | 9.8 | 2025-12-22 | ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can… |
CVE-2023-53979 | High | 8.8 | 2025-12-22 | MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attacker… |
CVE-2023-53978 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject mal… |
CVE-2023-53977 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malic… |
CVE-2023-53976 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject ma… |
CVE-2023-53975 | High | 7.5 | 2025-12-22 | Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters… |
CVE-2023-53974 | High | 7.5 | 2025-12-22 | D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST… |
CVE-2023-53973 | High | 8.4 | 2025-12-22 | Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorized system locations… |
CVE-2023-53972 | High | 7.5 | 2025-12-22 | WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries… |
CVE-2023-53971 | High | 8.8 | 2025-12-22 | WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. A… |
CVE-2023-53970 | High | 7.5 | 2025-12-22 | Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-boun… |
CVE-2023-53969 | High | 7.5 | 2025-12-22 | Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addres… |
CVE-2023-53968 | Critical | 9.8 | 2025-12-22 | Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addres… |
CVE-2023-53967 | High | 7.5 | 2025-12-22 | Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the cu… |
CVE-2023-53966 | Critical | 9.8 | 2025-12-22 | SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafte… |
CVE-2023-53965 | High | 8.4 | 2025-12-22 | SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated… |
CVE-2023-53964 | Critical | 9.8 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to re… |
CVE-2023-53963 | Critical | 9.8 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell comma… |
CVE-2023-53962 | High | 7.5 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through… |
CVE-2023-53961 | Medium | 4.3 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user con… |
CVE-2023-53960 | Critical | 9.8 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipula… |
CVE-2023-53955 | Critical | 9.8 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden s… |
CVE-2023-47232 | Medium | 4.3 | 2025-12-21 | Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6. |
CVE-2023-25446 | High | 7.7 | 2025-12-21 | Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-25445 | Medium | 5.4 | 2025-12-21 | Missing Authorization vulnerability in HappyFiles HappyFiles Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hap… |
CVE-2023-25068 | Medium | 4.3 | 2025-12-21 | Missing Authorization vulnerability in Mapro Collins Magazine Edge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects M… |
CVE-2023-53959 | Critical | 9.8 | 2025-12-19 | FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the appl… |
CVE-2023-53958 | High | 7.5 | 2025-12-19 | LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation… |
CVE-2023-53957 | Critical | 9.8 | 2025-12-19 | Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick… |
CVE-2023-53956 | High | 8.8 | 2025-12-19 | Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager… |
CVE-2023-53954 | Medium | 6.2 | 2025-12-19 | ActFax 10.10 contains an unquoted service path vulnerability that allows local attackers to potentially escalate privileges by exploiting the ActiveFaxServiceN… |
CVE-2023-53953 | Medium | 5.4 | 2025-12-19 | WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating web pages. A… |
CVE-2023-53952 | High | 8.8 | 2025-12-19 | Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through t… |
CVE-2023-53951 | Critical | 9.8 | 2025-12-19 | Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage th… |
CVE-2023-53950 | Critical | 9.8 | 2025-12-19 | InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file extension restrictions through filename… |
CVE-2023-53949 | High | 8.4 | 2025-12-19 | AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Att… |
CVE-2023-53948 | Critical | 9.8 | 2025-12-19 | Lilac-Reloaded for Nagios 2.0.8 contains a remote code execution vulnerability in the autodiscovery feature that allows attackers to inject arbitrary commands… |
CVE-2023-53947 | High | 8.4 | 2025-12-19 | OCS Inventory NG 2.3.0.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges to system level. Attackers can plac… |
CVE-2023-53946 | High | 8.4 | 2025-12-19 | Arcsoft PhotoStudio 6.0.0.172 contains an unquoted service path vulnerability in the ArcSoft Exchange Service that allows local attackers to escalate privilege… |
CVE-2023-53945 | High | 8.8 | 2025-12-19 | BrainyCP 1.0 contains an authenticated remote code execution vulnerability that allows logged-in users to inject arbitrary commands through the crontab configu… |
CVE-2023-30971 | Medium | 6.8 | 2025-12-19 | Gotham Gaia application was found to be exposing multiple unauthenticated endpoints. |
CVE-2023-53944 | Medium | 6.5 | 2025-12-18 | EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypass… |
CVE-2023-53943 | Medium | 5.3 | 2025-12-18 | GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers c… |
CVE-2023-53942 | High | 8.8 | 2025-12-18 | File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Att… |
CVE-2023-53941 | Critical | 9.8 | 2025-12-18 | EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting m… |
CVE-2023-53940 | High | 7.8 | 2025-12-18 | Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown fi… |
CVE-2023-53939 | Medium | 5.4 | 2025-12-18 | TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder nam… |
CVE-2023-53938 | Medium | 5.4 | 2025-12-18 | RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input paramet… |
CVE-2023-53937 | High | 7.8 | 2025-12-18 | Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library… |
CVE-2023-53936 | Medium | 4.8 | 2025-12-18 | Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titl… |
CVE-2023-53935 | Medium | 5.4 | 2025-12-18 | WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attac… |
CVE-2023-53934 | High | 7.5 | 2025-12-18 | A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improp… |
CVE-2023-53738 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can… |
CVE-2023-53737 | Medium | 4.8 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. At… |
CVE-2023-53736 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Att… |
CVE-2023-53933 | High | 8.8 | 2025-12-17 | Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attack… |
CVE-2023-53932 | Medium | 5.4 | 2025-12-17 | Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation… |
CVE-2023-53931 | Medium | 6.1 | 2025-12-17 | Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to inject malicious scripts… |
CVE-2023-53930 | High | 7.5 | 2025-12-17 | ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating th… |
CVE-2023-53929 | High | 8.8 | 2025-12-17 | phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can mod… |
CVE-2023-53928 | Medium | 5.4 | 2025-12-17 | PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded Ja… |
CVE-2023-53927 | Medium | 5.4 | 2025-12-17 | PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through section… |
CVE-2023-53926 | Critical | 9.8 | 2025-12-17 | PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attacke… |
CVE-2023-53925 | Medium | 6.1 | 2025-12-17 | UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files with embedded JavaScript. Attackers can… |
CVE-2023-53924 | High | 8.8 | 2025-12-17 | UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension durin… |
CVE-2023-53923 | Critical | 9.8 | 2025-12-17 | UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController… |
CVE-2023-53922 | Critical | 9.8 | 2025-12-17 | TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious… |
CVE-2023-53921 | Critical | 9.8 | 2025-12-17 | SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory. Attackers… |
CVE-2023-53920 | Medium | 5.4 | 2025-12-17 | PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface (podcas… |
CVE-2023-53919 | Medium | 5.4 | 2025-12-17 | PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface (… |
CVE-2023-53918 | Medium | 6.1 | 2025-12-17 | PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface (episod… |
CVE-2023-53917 | Medium | 6.5 | 2025-12-17 | Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database que… |
CVE-2023-53916 | Medium | 4.6 | 2025-12-17 | Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administ… |
CVE-2023-53915 | Medium | 4.6 | 2025-12-17 | Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting HTML content int… |
CVE-2023-53914 | Critical | 9.8 | 2025-12-17 | UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserCo… |
CVE-2023-53913 | High | 8.8 | 2025-12-17 | Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can c… |
CVE-2023-53912 | Medium | 6.2 | 2025-12-17 | USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execut… |
CVE-2023-53911 | Medium | 5.4 | 2025-12-17 | Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scr… |
CVE-2023-53910 | Medium | 5.4 | 2025-12-17 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags… |
CVE-2023-53909 | Medium | 5.4 | 2025-12-17 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG… |
CVE-2023-53908 | High | 8.8 | 2025-12-17 | HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configurati… |
CVE-2023-53907 | Medium | 6.5 | 2025-12-17 | Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files… |
CVE-2023-53906 | Medium | 4.8 | 2025-12-17 | projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the cust… |
CVE-2023-53905 | High | 8.0 | 2025-12-17 | ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can cr… |
CVE-2023-53904 | Medium | 4.6 | 2025-12-17 | Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie cat… |
CVE-2023-53900 | High | 8.8 | 2025-12-16 | Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administ… |
CVE-2023-53896 | High | 7.5 | 2025-12-16 | D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attackers to download device configuration set… |
CVE-2023-53903 | Medium | 5.4 | 2025-12-16 | WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript… |
CVE-2023-53902 | Medium | 6.5 | 2025-12-16 | WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files by manipulating directory path p… |
CVE-2023-53901 | Medium | 5.4 | 2025-12-16 | WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can u… |
CVE-2023-53899 | Critical | 9.8 | 2025-12-16 | PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can… |
CVE-2023-53898 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert i… |
CVE-2023-53897 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can i… |
CVE-2023-53895 | Critical | 9.8 | 2025-12-16 | PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the conf… |
CVE-2023-53894 | Critical | 9.8 | 2025-12-16 | phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. At… |