# CVEs published 2023-01-07

48 CVEs were published on January 7, 2023: 1 critical, 6 high. Days are UTC.

- [CVE-2022-2666](https://cve.now/CVE-2022-2666.md): SourceCodester Loan Management System login.php sql injection (CVSS 6.3, SourceCodester Loan Management System)
- [CVE-2021-4301](https://cve.now/CVE-2021-4301.md): slackero phpwcms sql injection (CVSS 6.3, slackero phpwcms)
- [CVE-2014-125029](https://cve.now/CVE-2014-125029.md): ttskch PaginationServiceProvider Demo index.php sql injection (CVSS 5.5, ttskch PaginationServiceProvider · ttskch/pagination-servic…)
- [CVE-2022-1102](https://cve.now/CVE-2022-1102.md): SourceCodester Royale Event Management System companyprofile.php cross site scripting (CVSS 4.3, SourceCodester Royale Event Management System)
- [CVE-2022-1101](https://cve.now/CVE-2022-1101.md): SourceCodester Royale Event Management System userregister.php improper authentication (CVSS 7.3, SourceCodester Royale Event Management System)
- [CVE-2013-10009](https://cve.now/CVE-2013-10009.md): DrAzraelTod pyChao \_\_init\_\_.py lesen sql injection (CVSS 5.5, DrAzraelTod pyChao)
- [CVE-2016-15014](https://cve.now/CVE-2016-15014.md): CESNET theme-cesnet resetpassword.php insufficiently protected credentials (CVSS 3.3, theme-cesnet)
- [CVE-2014-125065](https://cve.now/CVE-2014-125065.md): john5223 bottle-auth sql injection (CVSS 5.5, john5223 bottle-auth)
- [CVE-2015-10029](https://cve.now/CVE-2015-10029.md): kelvinmo simplexrd simplexrd.class.php xml external entity reference (CVSS 5.5, kelvinmo simplexrd · kelvinmo/simplexrd)
- [CVE-2020-36646](https://cve.now/CVE-2020-36646.md): MediaArea ZenLib Ztring.cpp Date\_From\_Seconds\_1970\_Local unknown vulnerability (CVSS 3.5, MediaArea ZenLib)
- [CVE-2016-15013](https://cve.now/CVE-2016-15013.md): ForumHulp searchresults listener.php list\_keywords sql injection (CVSS 5.5, ForumHulp searchresults)
- [CVE-2021-4307](https://cve.now/CVE-2021-4307.md): Yomguithereal Baobab prototype pollution (CVSS 6.3, Yomguithereal Baobab · baobab)
- [CVE-2017-20164](https://cve.now/CVE-2017-20164.md): Symbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirect (CVSS 6.3, Symbiote Seed · symbiote/silverstripe-seed)
- [CVE-2014-125063](https://cve.now/CVE-2014-125063.md): ada-l0velace Bid sql injection (CVSS 5.5, ada-l0velace Bid)
- [CVE-2015-10028](https://cve.now/CVE-2015-10028.md): ss15-this-is-sparta Main Page roomElement.js cross site scripting (CVSS 3.5, ss15-this-is-sparta)
- [CVE-2020-36645](https://cve.now/CVE-2020-36645.md): square squalor sql injection (CVSS 5.5, square squalor · github.com/square/squalor)
- [CVE-2015-10027](https://cve.now/CVE-2015-10027.md): hydrian TTRSS-Auth-LDAP Username ldap injection (CVSS 5.5, hydrian TTRSS-Auth-LDAP)
- [CVE-2014-125062](https://cve.now/CVE-2014-125062.md): ananich bitstorm announce.php sql injection (CVSS 5.5, ananich bitstorm)
- [CVE-2021-4306](https://cve.now/CVE-2021-4306.md): cronvel terminal-kit redos (CVSS 3.5, cronvel terminal-kit · terminal-kit)
- [CVE-2016-15012](https://cve.now/CVE-2016-15012.md): forcedotcom SalesforceMobileSDK-Windows QuerySpec.cs ComputeCountSql sql injection (CVSS 5.5, forcedotcom SalesforceMobileSDK-Windows)
- [CVE-2015-10026](https://cve.now/CVE-2015-10026.md): tiredtyrant flairbot flair.py sql injection (CVSS 5.5, tiredtyrant flairbot)
- [CVE-2022-4880](https://cve.now/CVE-2022-4880.md): stakira OpenUtau ZIP Archive VoicebankInstaller.cs VoicebankInstaller path traversal (CVSS 5.5, stakira OpenUtau)
- [CVE-2014-125061](https://cve.now/CVE-2014-125061.md): peel filebroker common.rb select\_transfer\_status\_desc sql injection (CVSS 5.5, peel filebroker)
- [CVE-2015-10025](https://cve.now/CVE-2015-10025.md): luelista miniConf URL Scanning MessageView.cs denial of service (CVSS 3.5, luelista miniConf)
- [CVE-2014-125060](https://cve.now/CVE-2014-125060.md): holdennb CollabCal calenderServer.cpp handleGet improper authentication (CVSS 7.3, holdennb CollabCal)
- [CVE-2014-125059](https://cve.now/CVE-2014-125059.md): sternenseemann sternenblog main.c blog\_index file inclusion (CVSS 5.0, sternenseemann sternenblog)
- [CVE-2015-10024](https://cve.now/CVE-2015-10024.md): hoffie larasync file\_storage.go path traversal (CVSS 5.5, hoffie larasync)
- [CVE-2015-10023](https://cve.now/CVE-2015-10023.md): Fumon trello-octometric srv.go main sql injection (CVSS 5.5, Fumon trello-octometric)
- [CVE-2018-25071](https://cve.now/CVE-2018-25071.md): roxlukas LMeve proxy.php insert\_log sql injection (CVSS 5.5, roxlukas LMeve)
- [CVE-2015-10022](https://cve.now/CVE-2015-10022.md): IISH nlgis2 custom\_import.pl sql injection (CVSS 5.5, IISH nlgis2)
- [CVE-2015-10021](https://cve.now/CVE-2015-10021.md): ritterim definely database.js cross site scripting (CVSS 3.5, ritterim definely)
- [CVE-2014-125058](https://cve.now/CVE-2014-125058.md): LearnMeSomeCodes project3 search.rb search\_first\_name sql injection (CVSS 5.5, LearnMeSomeCodes project3)
- [CVE-2018-25070](https://cve.now/CVE-2018-25070.md): polterguy Phosphorus Five CSV Import NonQuery.cs csv.Read sql injection (CVSS 5.5, polterguy Phosphorus Five)
- [CVE-2014-125057](https://cve.now/CVE-2014-125057.md): mrobit robitailletheknot CSRF Token filters.php comparison (CVSS 3.1, mrobit robitailletheknot)
- [CVE-2014-125056](https://cve.now/CVE-2014-125056.md): Pylons horus services.py timing discrepancy (CVSS 2.6, Pylons horus)
- [CVE-2020-36644](https://cve.now/CVE-2020-36644.md): jamesmartin Inline SVG URL Parameter helpers.rb cross site scripting (CVSS 3.5, jamesmartin Inline SVG · inline\_svg)
- [CVE-2014-125055](https://cve.now/CVE-2014-125055.md): agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancy (CVSS 2.6, agnivade easy-scrypt · github.com/agnivade/easy-scrypt)
- [CVE-2015-10019](https://cve.now/CVE-2015-10019.md): foxoverflow MySimplifiedSQL MySimplifiedSQL\_Examples.php cross site scripting (CVSS 3.5, foxoverflow MySimplifiedSQL)
- [CVE-2014-125054](https://cve.now/CVE-2014-125054.md): koroket RedditOnRails Vote access control (CVSS 4.3, koroket RedditOnRails)
- [CVE-2018-25069](https://cve.now/CVE-2018-25069.md): Netis Netcore Router hard-coded password (CVSS 7.3, Netis Netcore Router)
- [CVE-2023-0114](https://cve.now/CVE-2023-0114.md): Netis Netcore Router Backup param.file.tgz cleartext storage in a file or on disk (CVSS 3.3, Netis Netcore Router)
- [CVE-2023-0113](https://cve.now/CVE-2023-0113.md): Netis Netcore Router Backup param.file.tgz information disclosure (CVSS 5.3, Netis Netcore Router)
- [CVE-2023-0106](https://cve.now/CVE-2023-0106.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 9.0, usememos/memos · github.com/usememos/memos)
- [CVE-2023-0107](https://cve.now/CVE-2023-0107.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 6.5, usememos/memos · github.com/usememos/memos)
- [CVE-2023-0108](https://cve.now/CVE-2023-0108.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.1, usememos/memos · github.com/usememos/memos)
- [CVE-2023-0110](https://cve.now/CVE-2023-0110.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.1, usememos/memos · github.com/usememos/memos)
- [CVE-2023-0111](https://cve.now/CVE-2023-0111.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 5.4, usememos/memos · github.com/usememos/memos)
- [CVE-2023-0112](https://cve.now/CVE-2023-0112.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.6, usememos/memos · github.com/usememos/memos)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.