# CVEs published 2023-01-16

67 CVEs were published on January 16, 2023: 3 critical, 7 high. Days are UTC.

- [CVE-2022-3087](https://cve.now/CVE-2022-3087.md): Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to e (CVSS 7.8, Fuji Electric Tellus Lite V-Simulator)
- [CVE-2015-10057](https://cve.now/CVE-2015-10057.md): Little Apps Little Software Stats Password Reset class.securelogin.php access control (CVSS 4.6, Little Apps Little Software Stats)
- [CVE-2015-10056](https://cve.now/CVE-2015-10056.md): 2071174A vinylmap views.py contact sql injection (CVSS 5.5, 2071174A vinylmap)
- [CVE-2023-0327](https://cve.now/CVE-2023-0327.md): saemorris TheRadSystem users.php cross site scripting (CVSS 3.5, saemorris TheRadSystem)
- [CVE-2015-10055](https://cve.now/CVE-2015-10055.md): PictureThisWebServer user.js router.post sql injection (CVSS 5.5, PictureThisWebServer)
- [CVE-2015-10054](https://cve.now/CVE-2015-10054.md): githuis P2Manage Database.cs Execute sql injection (CVSS 5.5, githuis P2Manage)
- [CVE-2014-125080](https://cve.now/CVE-2014-125080.md): frontaccounting faplanet path traversal (CVSS 5.5, frontaccounting faplanet)
- [CVE-2022-2658](https://cve.now/CVE-2022-2658.md): WP Spell Check \< 9.13 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, WP Spell Check)
- [CVE-2022-4299](https://cve.now/CVE-2022-4299.md): Metricool \< 1.18 - Admin+ Stored XSS (CVSS 4.8, Metricool)
- [CVE-2022-4431](https://cve.now/CVE-2022-4431.md): WOOCS \< 1.3.9.4 - Contributor+ Stored XSS (CVSS 5.4, WOOCS)
- [CVE-2022-4309](https://cve.now/CVE-2022-4309.md): Subscribe2 \< 10.38 - User Deletion via CSRF (CVSS 3.1, Subscribe2)
- [CVE-2022-4295](https://cve.now/CVE-2022-4295.md): Show All Comments \< 7.0.1 - Reflected XSS (CVSS 6.1, Show All Comments)
- [CVE-2022-4578](https://cve.now/CVE-2022-4578.md): Video Conferencing with Zoom \< 4.0.10 - Contributor+ Stored XSS (CVSS 5.4, Video Conferencing with Zoom)
- [CVE-2022-4484](https://cve.now/CVE-2022-4484.md): Super Socializer \< 7.13.44 - Contributor+ Stored XSS (CVSS 5.4, Social Share, Social Login and Social Comments Plugin)
- [CVE-2022-4447](https://cve.now/CVE-2022-4447.md): Fontsy \<= 1.8.6 - Multiple Unauthenticated SQLi (CVSS 9.8, Fontsy)
- [CVE-2022-4451](https://cve.now/CVE-2022-4451.md): Sassy Social Share \< 3.3.45 - Contributor+ Stored XSS (CVSS 5.4, Social Sharing Plugin)
- [CVE-2022-4060](https://cve.now/CVE-2022-4060.md): User Post Gallery \<= 2.19 - Unauthenticated RCE (CVSS 9.8, User Post Gallery)
- [CVE-2022-4544](https://cve.now/CVE-2022-4544.md): MashShare \< 3.8.7 - Contributor+ Stored XSS (CVSS 5.4, Social Media Share Buttons | MashShare)
- [CVE-2022-4483](https://cve.now/CVE-2022-4483.md): Insert Pages \< 3.7.5 - Contributor+ Stored XSS (CVSS 5.4, Insert Pages)
- [CVE-2022-4460](https://cve.now/CVE-2022-4460.md): Sidebar Widgets by CodeLights \<= 1.4 - Contributor+ Stored XSS (CVSS 5.4, Sidebar Widgets by CodeLights)
- [CVE-2022-4476](https://cve.now/CVE-2022-4476.md): Download Manager \< 3.2.62 - Contributor+ Stored XSS (CVSS 5.4, Download Manager)
- [CVE-2022-4477](https://cve.now/CVE-2022-4477.md): Smash Balloon Social Post Feed \< 4.1.6 - Contributor+ Stored XSS (CVSS 5.4, Smash Balloon Social Post Feed)
- [CVE-2022-4508](https://cve.now/CVE-2022-4508.md): ConvertKit \< 2.0.5 - Contributor+ Stored XSS (CVSS 5.4, ConvertKit)
- [CVE-2022-4549](https://cve.now/CVE-2022-4549.md): Tickera \< 3.5.1.0 - Plugin Data Deletion via CSRF (CVSS 4.3, Tickera)
- [CVE-2022-4482](https://cve.now/CVE-2022-4482.md): Carousel, Slider, Gallery by WP Carousel \< 2.5.3 - Contributor+ Stored XSS (CVSS 5.4, Carousel, Slider, Gallery by WP Carousel)
- [CVE-2022-4478](https://cve.now/CVE-2022-4478.md): Font Awesome \< 4.3.2 - Contributor+ Stored XSS (CVSS 5.4, Font Awesome)
- [CVE-2022-4481](https://cve.now/CVE-2022-4481.md): Mesmerize Companion \< 1.6.135 - Contributor+ Stored XSS (CVSS 5.4, Mesmerize Companion)
- [CVE-2022-4655](https://cve.now/CVE-2022-4655.md): Welcart e-Commerce \< 2.8.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Welcart e-Commerce)
- [CVE-2022-4507](https://cve.now/CVE-2022-4507.md): Real Cookie Banner \< 3.4.10 - Contributor+ Stored XSS (CVSS 5.4, Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent)
- [CVE-2022-4442](https://cve.now/CVE-2022-4442.md): WCK \< 2.3.3 - Admin+ Stored XSS (CVSS 4.8, Custom Post Types and Custom Fields creator)
- [CVE-2022-4320](https://cve.now/CVE-2022-4320.md): WordPress Events Calendar Plugin \< 1.4.5 - Multiple Reflected XSS (CVSS 6.1, WordPress Events Calendar Plugin)
- [CVE-2022-4658](https://cve.now/CVE-2022-4658.md): RSSImport \<= 4.6.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, RSSImport)
- [CVE-2022-4571](https://cve.now/CVE-2022-4571.md): Seriously Simple Podcasting \< 2.19.1 - Contributor+ Stored XSS (CVSS 5.4, Seriously Simple Podcasting)
- [CVE-2022-4199](https://cve.now/CVE-2022-4199.md): Link Library \< 7.4.1 - Admin+ Stored XSS (CVSS 4.8, Link Library)
- [CVE-2022-4547](https://cve.now/CVE-2022-4547.md): Conditional Payment Methods for WooCommerce \<= 1.0 - Admin+ SQLi (CVSS 7.2, Conditional Payment Methods for WooCommerce)
- [CVE-2022-4101](https://cve.now/CVE-2022-4101.md): Images Optimize and Upload CF7 \<= 2.1.4 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, Images Optimize and Upload CF7)
- [CVE-2022-4480](https://cve.now/CVE-2022-4480.md): Click to Chat \< 3.18.1 - Contributor+ Stored XSS (CVSS 5.4, Click to Chat)
- [CVE-2022-4464](https://cve.now/CVE-2022-4464.md): Themify Portfolio Post \< 1.2.1 - Contributor+ Stored XSS (CVSS 5.4, Themify Portfolio Post)
- [CVE-2022-4487](https://cve.now/CVE-2022-4487.md): Easy Accordion \< 2.2.0 - Contributor+ Stored XSS (CVSS 5.4, Easy Accordion)
- [CVE-2022-4653](https://cve.now/CVE-2022-4653.md): Greenshift – animation and page builder blocks \< 4.8.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Greenshift)
- [CVE-2022-4453](https://cve.now/CVE-2022-4453.md): 3D FlipBook \<= 1.13.2 - Contributor+ Stored XSS (CVSS 6.1, 3D FlipBook)
- [CVE-2022-3904](https://cve.now/CVE-2022-3904.md): MonsterInsights \< 8.9.1 - Stored Cross-Site Scripting via Google Analytics (CVSS 6.1, MonsterInsights)
- [CVE-2022-4469](https://cve.now/CVE-2022-4469.md): Simple Membership \< 4.2.2 - Contributor+ Stored XSS (CVSS 5.4, Simple Membership)
- [CVE-2022-4486](https://cve.now/CVE-2022-4486.md): Meteor Slides \< 1.5.7 - Contributor+ Stored XSS (CVSS 5.4, Meteor Slides)
- [CVE-2022-4330](https://cve.now/CVE-2022-4330.md): WP Attachments \< 5.0.6 - Admin+ Stored XSS (no CVSS, WP Attachments)
- [CVE-2022-4449](https://cve.now/CVE-2022-4449.md): Page Scroll To ID \< 1.7.6 - Contributor+ Stored XSS (CVSS 5.4, Page scroll to id)
- [CVE-2022-4465](https://cve.now/CVE-2022-4465.md): WP Video Lightbox \< 1.9.7 - Contributor+ Stored XSS (CVSS 5.4, WP Video Lightbox)
- [CVE-2022-4648](https://cve.now/CVE-2022-4648.md): Real Testimonials \< 2.6.0 - Contributor+ Stored XSS (CVSS 5.4, Real Testimonials)
- [CVE-2023-0324](https://cve.now/CVE-2023-0324.md): SourceCodester Online Tours & Travels Management System page-login.php sql injection (CVSS 7.3, SourceCodester Online Tours & Travels Management System)
- [CVE-2022-4890](https://cve.now/CVE-2022-4890.md): abhilash1985 PredictApp Cookie new\_framework\_defaults\_7\_0.rb deserialization (CVSS 6.3, abhilash1985 PredictApp)
- [CVE-2021-4313](https://cve.now/CVE-2021-4313.md): NethServer phonenehome index.php get\_country\_coor sql injection (CVSS 5.5, NethServer phonenehome)
- [CVE-2018-25076](https://cve.now/CVE-2018-25076.md): Events Extension events.php searchResults sql injection (CVSS 5.5, Events Extension)
- [CVE-2015-10053](https://cve.now/CVE-2015-10053.md): prodigasistemas curupira passwords\_controller.rb sql injection (CVSS 5.5, prodigasistemas curupira · curupira)
- [CVE-2016-15020](https://cve.now/CVE-2016-15020.md): liftkit database Query.php processOrderBy sql injection (CVSS 5.5, liftkit database · liftkit/database)
- [CVE-2013-10012](https://cve.now/CVE-2013-10012.md): antonbolling clan7ups Login/Session sql injection (CVSS 5.5, antonbolling clan7ups)
- [CVE-2022-41703](https://cve.now/CVE-2022-41703.md): Apache Superset: SQL injection vulnerability in adhoc clauses (CVSS 5.4, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-45438](https://cve.now/CVE-2022-45438.md): Apache Superset: Dashboard metadata information leak (CVSS 5.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-43721](https://cve.now/CVE-2022-43721.md): Apache Superset: Open Redirect Vulnerability (CVSS 5.4, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-43720](https://cve.now/CVE-2022-43720.md): Apache Superset: Improper rendering of user input (CVSS 5.4, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-43719](https://cve.now/CVE-2022-43719.md): Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API (CVSS 8.8, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-43718](https://cve.now/CVE-2022-43718.md): Apache Superset: Cross-Site Scripting vulnerability on upload forms (CVSS 5.4, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-43717](https://cve.now/CVE-2022-43717.md): Apache Superset: Cross-Site Scripting on dashboards (CVSS 5.4, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-4258](https://cve.now/CVE-2022-4258.md): Hima: Unquoted path vulnerabilities in HIMA PC based Software (CVSS 7.8, HIMA HOPCS · HIMA X-OPC DA +2)
- [CVE-2022-47630](https://cve.now/CVE-2022-47630.md): Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. (CVSS 7.4)
- [CVE-2023-0315](https://cve.now/CVE-2023-0315.md): Command Injection in froxlor/froxlor (CVSS 7.2, froxlor/froxlor)
- [CVE-2023-0316](https://cve.now/CVE-2023-0316.md): Path Traversal: '\\..\\filename' in froxlor/froxlor (CVSS 6.8, froxlor/froxlor)
- [CVE-2023-0323](https://cve.now/CVE-2023-0323.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1, pimcore/pimcore)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.