# CVEs published 2023-01-15 31 CVEs were published on January 15, 2023: 2 critical, 6 high. Days are UTC. - [CVE-2018-25075](https://cve.now/CVE-2018-25075.md): karsany OBridge ProcedureDao.java getAllStandaloneProcedureAndFunction sql injection (CVSS 4.6, karsany OBridge) - [CVE-2016-15019](https://cve.now/CVE-2016-15019.md): tombh jekbox server.rb exposure of information through directory listing (CVSS 4.3, tombh jekbox) - [CVE-2016-15018](https://cve.now/CVE-2016-15018.md): krail-jpa sql injection (CVSS 5.5, krail-jpa) - [CVE-2015-10052](https://cve.now/CVE-2015-10052.md): calesanz gibb-modul-151 login redirect (CVSS 4.6, calesanz gibb-modul-151) - [CVE-2015-10051](https://cve.now/CVE-2015-10051.md): bony2023 Discussion-Board main.php display\_all\_replies sql injection (CVSS 5.5, bony2023 Discussion-Board) - [CVE-2015-10050](https://cve.now/CVE-2015-10050.md): brandonfire miRNA\_Database\_by\_PHP\_MySql model.php count\_rna sql injection (CVSS 5.5, brandonfire miRNA\_Database\_by\_PHP\_MySql) - [CVE-2015-10049](https://cve.now/CVE-2015-10049.md): Overdrive Eletrônica course-builder oeditor.html cross site scripting (CVSS 3.5, Overdrive Eletrônica course-builder) - [CVE-2023-0305](https://cve.now/CVE-2023-0305.md): SourceCodester Online Food Ordering System Login Module admin\_class.php sql injection (CVSS 6.3, SourceCodester Online Food Ordering System) - [CVE-2023-0304](https://cve.now/CVE-2023-0304.md): SourceCodester Online Food Ordering System Signup Module admin\_class.php sql injection (CVSS 6.3, SourceCodester Online Food Ordering System) - [CVE-2023-0303](https://cve.now/CVE-2023-0303.md): SourceCodester Online Food Ordering System view\_prod.php sql injection (CVSS 6.3, SourceCodester Online Food Ordering System) - [CVE-2015-10048](https://cve.now/CVE-2015-10048.md): bmattoso desafio\_buzz\_woody sql injection (CVSS 5.5, bmattoso desafio\_buzz\_woody) - [CVE-2015-10047](https://cve.now/CVE-2015-10047.md): KYUUBl school-register DBManager.java sql injection (CVSS 5.5, KYUUBl school-register) - [CVE-2015-10046](https://cve.now/CVE-2015-10046.md): lolfeedback sql injection (CVSS 5.5, lolfeedback) - [CVE-2015-10045](https://cve.now/CVE-2015-10045.md): tutrantta project\_todolist Database.php update sql injection (CVSS 5.5, tutrantta project\_todolist) - [CVE-2015-10044](https://cve.now/CVE-2015-10044.md): gophergala sqldump sql injection (CVSS 5.5, gophergala sqldump) - [CVE-2014-125079](https://cve.now/CVE-2014-125079.md): agy pontifex.http Http.coffee sql injection (CVSS 5.5, agy pontifex.http) - [CVE-2014-125078](https://cve.now/CVE-2014-125078.md): yanheven console horizon.instances.js cross site scripting (CVSS 3.5, yanheven console) - [CVE-2014-125077](https://cve.now/CVE-2014-125077.md): pointhi searx\_stats cron.php sql injection (CVSS 5.5, pointhi searx\_stats) - [CVE-2022-4889](https://cve.now/CVE-2022-4889.md): visegripped Stracker api.php getHistory sql injection (CVSS 5.5, visegripped Stracker) - [CVE-2023-0302](https://cve.now/CVE-2023-0302.md): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2 (CVSS 8.6, radareorg/radare2) - [CVE-2023-0306](https://cve.now/CVE-2023-0306.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 9.1, thorsten/phpmyfaq) - [CVE-2023-0307](https://cve.now/CVE-2023-0307.md): Weak Password Requirements in thorsten/phpmyfaq (CVSS 5.7, thorsten/phpmyfaq) - [CVE-2023-0308](https://cve.now/CVE-2023-0308.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.6, thorsten/phpmyfaq) - [CVE-2023-0309](https://cve.now/CVE-2023-0309.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.6, thorsten/phpmyfaq) - [CVE-2023-0310](https://cve.now/CVE-2023-0310.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 9.8, thorsten/phpmyfaq) - [CVE-2023-0311](https://cve.now/CVE-2023-0311.md): Improper Authentication in thorsten/phpmyfaq (CVSS 5.3, thorsten/phpmyfaq) - [CVE-2023-0312](https://cve.now/CVE-2023-0312.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.6, thorsten/phpmyfaq) - [CVE-2023-0313](https://cve.now/CVE-2023-0313.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7, thorsten/phpmyfaq) - [CVE-2023-0314](https://cve.now/CVE-2023-0314.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 6.5, thorsten/phpmyfaq) - [CVE-2023-23590](https://cve.now/CVE-2023-23590.md): Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated (CVSS 7.5) - [CVE-2023-23595](https://cve.now/CVE-2023-23595.md): BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-01-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.