2023 CVEs (page 76)
Page 76 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-7137 | Medium | 6.3 | 2023-12-28 | A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functional… |
CVE-2023-7136 | Low | 2.4 | 2023-12-28 | A vulnerability classified as problematic was found in code-projects Record Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2023-7135 | Low | 2.4 | 2023-12-28 | A vulnerability classified as problematic has been found in code-projects Record Management System 1.0. Affected is an unknown function of the file /main/offic… |
CVE-2023-7134 | Medium | 6.3 | 2023-12-28 | A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipu… |
CVE-2023-50839 | Critical | 9.3 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plug… |
CVE-2023-50838 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms a… |
CVE-2023-50847 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart… |
CVE-2023-50846 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration… |
CVE-2023-50845 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirecto… |
CVE-2023-50844 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in James Ward Mail logging – WP Mail Catcher.This issue affe… |
CVE-2023-50843 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Clockwork Clockwork SMS Notfications.This issue affects C… |
CVE-2023-50842 | High | 8.5 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig C… |
CVE-2023-50841 | High | 8.5 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress – Appointment Booking Cal… |
CVE-2023-50840 | High | 8.5 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop, oplugins Booking Manager.This issue affects Bo… |
CVE-2023-7133 | Medium | 4.3 | 2023-12-28 | A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the comp… |
CVE-2023-7132 | Low | 3.5 | 2023-12-28 | A vulnerability was found in code-projects Intern Membership Management System 2.0. It has been classified as problematic. This affects an unknown part of the… |
CVE-2023-7131 | Medium | 6.3 | 2023-12-28 | A vulnerability was found in code-projects Intern Membership Management System 2.0 and classified as critical. Affected by this issue is some unknown functiona… |
CVE-2023-7163 | Critical | 10.0 | 2023-12-28 | A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could… |
CVE-2023-7129 | Medium | 5.5 | 2023-12-28 | A vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Affected is an unknown function of the component Voters Login… |
CVE-2023-52082 | High | 8.8 | 2023-12-28 | Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is on… |
CVE-2023-52081 | Medium | 5.3 | 2023-12-28 | ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to… |
CVE-2023-52079 | Medium | 6.8 | 2023-12-28 | msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck thr… |
CVE-2023-50267 | Medium | 4.3 | 2023-12-28 | MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to… |
CVE-2023-7128 | Medium | 6.3 | 2023-12-28 | A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. This issue affects some unknown processing of the file /a… |
CVE-2023-7127 | Medium | 6.3 | 2023-12-28 | A vulnerability classified as critical was found in code-projects Automated Voting System 1.0. This vulnerability affects unknown code of the component Login… |
CVE-2023-50470 | Medium | 5.4 | 2023-12-28 | A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2023-46987 | High | 8.8 | 2023-12-28 | SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php. |
CVE-2023-7126 | Medium | 6.3 | 2023-12-28 | A vulnerability classified as critical has been found in code-projects Automated Voting System 1.0. This affects an unknown part of the file /admin/ of the com… |
CVE-2023-50855 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects P… |
CVE-2023-50854 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects… |
CVE-2023-50853 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerc… |
CVE-2023-50852 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | B… |
CVE-2023-50851 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar — Simply Schedule… |
CVE-2023-50849 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This i… |
CVE-2023-50848 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: fro… |
CVE-2023-50873 | Medium | 4.3 | 2023-12-28 | Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through… |
CVE-2023-50860 | Medium | 6.5 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia… |
CVE-2023-50859 | Medium | 6.5 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affe… |
CVE-2023-50858 | Medium | 5.4 | 2023-12-28 | Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This… |
CVE-2023-50857 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newslette… |
CVE-2023-50856 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Cus… |
CVE-2023-50836 | Medium | 5.9 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects… |
CVE-2023-36381 | Medium | 6.6 | 2023-12-28 | Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5. |
CVE-2023-32795 | High | 8.2 | 2023-12-28 | Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3. |
CVE-2023-32513 | High | 7.5 | 2023-12-28 | Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fun… |
CVE-2023-27447 | Medium | 5.3 | 2023-12-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, Gravit… |
CVE-2023-51501 | High | 7.1 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme al… |
CVE-2023-50874 | Medium | 6.5 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More… |
CVE-2023-4672 | Medium | 6.1 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software ECOP allows Reflected XSS. This issue af… |
CVE-2023-4671 | Critical | 9.8 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software ECOP allows Command Line Execution throug… |
CVE-2023-45702 | Medium | 6.2 | 2023-12-28 | An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.. |
CVE-2023-50038 | High | 8.8 | 2023-12-28 | There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. |
CVE-2023-45701 | Medium | 4.3 | 2023-12-28 | HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information c… |
CVE-2023-50692 | High | 8.8 | 2023-12-28 | File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url pa… |
CVE-2023-49469 | Medium | 6.1 | 2023-12-28 | Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function. |
CVE-2023-46989 | High | 7.8 | 2023-12-28 | SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getP… |
CVE-2023-50445 | High | 7.8 | 2023-12-28 | Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7… |
CVE-2023-51010 | Medium | 5.3 | 2023-12-28 | An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking. |
CVE-2023-51006 | High | 7.5 | 2023-12-28 | An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors. |
CVE-2023-49230 | High | 8.8 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configura… |
CVE-2023-49229 | Medium | 4.3 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged use… |
CVE-2023-49228 | Medium | 6.4 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical ac… |
CVE-2023-7124 | Medium | 4.3 | 2023-12-28 | A vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unknown function of the file search.php. T… |
CVE-2023-34829 | Medium | 6.5 | 2023-12-28 | Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext. |
CVE-2023-7123 | Medium | 6.3 | 2023-12-28 | A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of… |
CVE-2023-6879 | Critical | 9.0 | 2023-12-27 | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
CVE-2023-49003 | Medium | 5.3 | 2023-12-27 | An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer… |
CVE-2023-49002 | High | 7.5 | 2023-12-27 | An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via interaction with c… |
CVE-2023-49001 | Critical | 9.8 | 2023-12-27 | An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrow… |
CVE-2023-49000 | Critical | 9.8 | 2023-12-27 | An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.I… |
CVE-2023-46918 | Medium | 4.6 | 2023-12-27 | Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup att… |
CVE-2023-51084 | Critical | 9.8 | 2023-12-27 | hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method. |
CVE-2023-51080 | High | 7.5 | 2023-12-27 | The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow. |
CVE-2023-51079 | Medium | 5.3 | 2023-12-27 | A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes… |
CVE-2023-51075 | High | 7.5 | 2023-12-27 | hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial… |
CVE-2023-51074 | Medium | 5.3 | 2023-12-27 | json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method. |
CVE-2023-47883 | Critical | 9.8 | 2023-12-27 | The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to… |
CVE-2023-47882 | High | 7.1 | 2023-12-27 | The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via a… |
CVE-2023-46919 | Medium | 6.3 | 2023-12-27 | Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr… |
CVE-2023-43955 | Critical | 9.8 | 2023-12-27 | The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary… |
CVE-2023-43481 | Critical | 9.8 | 2023-12-27 | An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript c… |
CVE-2023-52075 | High | 7.5 | 2023-12-27 | ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, R… |
CVE-2023-40038 | High | 8.8 | 2023-12-27 | Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID… |
CVE-2023-52077 | High | 8.9 | 2023-12-27 | Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by… |
CVE-2023-51700 | Medium | 6.4 | 2023-12-27 | Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile… |
CVE-2023-51697 | Medium | 4.3 | 2023-12-27 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF)… |
CVE-2023-51665 | Medium | 4.3 | 2023-12-27 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF)… |
CVE-2023-51664 | High | 7.3 | 2023-12-27 | tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command… |
CVE-2023-51443 | High | 7.5 | 2023-12-27 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2023-50255 | Critical | 9.3 | 2023-12-27 | Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be… |
CVE-2023-7116 | Medium | 6.3 | 2023-12-27 | A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the fi… |
CVE-2023-4641 | Medium | 4.7 | 2023-12-27 | A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-uti… |
CVE-2023-3171 | High | 7.5 | 2023-12-27 | A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed… |
CVE-2023-6190 | Critical | 9.8 | 2023-12-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Information Management… |
CVE-2023-52096 | High | 7.5 | 2023-12-26 | SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a St… |
CVE-2023-49438 | Medium | 6.1 | 2023-12-26 | An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafte… |
CVE-2023-48003 | Medium | 6.1 | 2023-12-26 | An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the… |
CVE-2023-6268 | Medium | 6.1 | 2023-12-26 | The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Refl… |
CVE-2023-6250 | High | 7.5 | 2023-12-26 | The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag |
CVE-2023-6166 | Medium | 6.1 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting |