# CVEs published 2023-02-21

85 CVEs were published on February 21, 2023: 10 critical, 11 high. Days are UTC.

- [CVE-2023-25157](https://cve.now/CVE-2023-25157.md): Unfiltered SQL Injection Vulnerabilities in Geoserver (CVSS 9.8, geoserver · org.geoserver.community:gs-jdbcconfig)
- [CVE-2023-25158](https://cve.now/CVE-2023-25158.md): Unfiltered SQL Injection in Geotools (CVSS 9.8, geotools · org.geotools:gt-jdbc)
- [CVE-2023-25657](https://cve.now/CVE-2023-25657.md): Remote code execution in Jinja2 template rendering in Nautobot (CVSS 7.5, nautobot)
- [CVE-2023-25811](https://cve.now/CVE-2023-25811.md): Persistent Cross site scripting (XSS) in Uptime Kuma (CVSS 6.3, louislam uptime-kuma)
- [CVE-2023-25810](https://cve.now/CVE-2023-25810.md): Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma (CVSS 6.3, louislam uptime-kuma)
- [CVE-2023-25812](https://cve.now/CVE-2023-25812.md): Allowed DELETE on resources on object locked buckets under Governance mode in Minio (CVSS 6.5, minio)
- [CVE-2017-20179](https://cve.now/CVE-2017-20179.md): InSTEDD Pollit tour\_controller.rb TourController Privilege Escalation (CVSS 6.3, InSTEDD Pollit)
- [CVE-2023-0946](https://cve.now/CVE-2023-0946.md): SourceCodester Best POS Management System sql injection (CVSS 6.3, SourceCodester Best POS Management System)
- [CVE-2023-0945](https://cve.now/CVE-2023-0945.md): SourceCodester Best POS Management System cross site scripting (CVSS 3.5, SourceCodester Best POS Management System)
- [CVE-2023-0943](https://cve.now/CVE-2023-0943.md): SourceCodester Best POS Management System Image save\_settings unrestricted upload (CVSS 4.7, SourceCodester Best POS Management System)
- [CVE-2023-0942](https://cve.now/CVE-2023-0942.md): Japanized For WooCommerce \<= 2.5.4 - Reflected Cross-Site Scripting (CVSS 6.1, shoheitanaka Japanized for WooCommerce)
- [CVE-2022-48282](https://cve.now/CVE-2022-48282.md): Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution (CVSS 6.6, MongoDB .NET/C# Driver · MongoDB.Driver)
- [CVE-2017-20178](https://cve.now/CVE-2017-20178.md): Codiad process.php saveJSON information disclosure (CVSS 3.1, Codiad · codiad/codiad)
- [CVE-2015-10085](https://cve.now/CVE-2015-10085.md): GoPistolet MTA denial of service (CVSS 3.5, GoPistolet · github.com/gopistolet/gopistolet)
- [CVE-2015-10084](https://cve.now/CVE-2015-10084.md): irontec klear-library BaseController.php \_prepareWhere sql injection (CVSS 5.5, irontec klear-library)
- [CVE-2015-10083](https://cve.now/CVE-2015-10083.md): harrystech Dynosaur-Rails application\_controller.rb basic\_auth improper authentication (CVSS 6.3, harrystech Dynosaur-Rails)
- [CVE-2023-25928](https://cve.now/CVE-2023-25928.md): IBM InfoSphere Information Server cross-site scripting (CVSS 4.6, IBM InfoSphere Information Server)
- [CVE-2022-3353](https://cve.now/CVE-2022-3353.md): IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products (CVSS 5.9, Hitachi Energy FOX61x TEGO1 · Hitachi Energy GMS600 +9)
- [CVE-2023-0938](https://cve.now/CVE-2023-0938.md): SourceCodester Music Gallery Site GET Request music\_list.php sql injection (CVSS 6.3, SourceCodester Music Gallery Site)
- [CVE-2023-0936](https://cve.now/CVE-2023-0936.md): TP-Link Archer C50 Web Management Interface denial of service (CVSS 6.5, TP-Link Archer C50)
- [CVE-2023-0935](https://cve.now/CVE-2023-0935.md): DolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injection (CVSS 6.3, DolphinPHP)
- [CVE-2023-0442](https://cve.now/CVE-2023-0442.md): Loan Comparison \< 1.5.2 - Reflected XSS via shortcode (CVSS 6.1, Loan Comparison)
- [CVE-2023-0419](https://cve.now/CVE-2023-0419.md): Shortcode for Font Awesome \< 1.4.1 - Contributor+ Stored XSS (no CVSS, Shortcode for Font Awesome)
- [CVE-2022-4714](https://cve.now/CVE-2022-4714.md): WP Dark Mode \< 4.0.0 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, WP Dark Mode)
- [CVE-2022-4754](https://cve.now/CVE-2022-4754.md): Easy Social Box \<= 4.1.2 - Contributor+ Stored XSS via Shortcode (no CVSS, Easy Social Box / Page Plugin)
- [CVE-2022-4386](https://cve.now/CVE-2022-4386.md): Intuitive Custom Post Order \< 3.1.4 - Arbitrary Menu Order Update via CSRF (no CVSS, Intuitive Custom Post Order)
- [CVE-2023-0232](https://cve.now/CVE-2023-0232.md): ShopLentor \< 2.5.4 - PHP Object Injection (CVSS 9.8, ShopLentor)
- [CVE-2022-4666](https://cve.now/CVE-2022-4666.md): Markup \<= 4.8.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Markup (JSON-LD) structured in schema.org)
- [CVE-2023-0059](https://cve.now/CVE-2023-0059.md): Youzify \< 1.2.2 - Contributor+ Stored XSS (CVSS 5.4, Youzify)
- [CVE-2023-0366](https://cve.now/CVE-2023-0366.md): Loan Comparison \< 1.5.3 - Contributor+ Stored XSS via shortcode (CVSS 5.4, Loan Comparison)
- [CVE-2022-4786](https://cve.now/CVE-2022-4786.md): Video.js - HTML5 Video Player for WordPress \<= 4.5.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Video.js)
- [CVE-2023-0540](https://cve.now/CVE-2023-0540.md): GS Filterable Portfolio \< 1.6.1 - Contributor+ Stored XSS (CVSS 5.4, GS Filterable Portfolio)
- [CVE-2023-0429](https://cve.now/CVE-2023-0429.md): Watu Quiz \< 3.3.8.3 - Admin+ Stored XSS (CVSS 3.5, Watu Quiz)
- [CVE-2023-0428](https://cve.now/CVE-2023-0428.md): Watu Quiz \< 3.3.8.2 - Reflected XSS (CVSS 7.5, Watu Quiz)
- [CVE-2022-4764](https://cve.now/CVE-2022-4764.md): Simple File Downloader \<= 1.0.4 - Contributor+ Stored XSS via Shortcode (CVSS 6.8, Simple File Downloader)
- [CVE-2023-0541](https://cve.now/CVE-2023-0541.md): GS Books Showcase \< 1.3.1 - Contributor+ Stored XSS (CVSS 6.8, GS Books Showcase)
- [CVE-2023-0453](https://cve.now/CVE-2023-0453.md): WP Private Message \< 1.0.6 - Private Message Disclosure via IDOR (CVSS 4.3, WP Private Message)
- [CVE-2022-4752](https://cve.now/CVE-2022-4752.md): Opening Hours \<= 2.3.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Opening Hours)
- [CVE-2023-0371](https://cve.now/CVE-2023-0371.md): EmbedSocial \< 1.1.28 - Contributor+ Stored XSS (CVSS 5.4, EmbedSocial)
- [CVE-2022-4791](https://cve.now/CVE-2022-4791.md): Product Slider and Carousel with Category for WooCommerce \< 2.8 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Product Slider and Carousel with Category for WooCommerce)
- [CVE-2022-4897](https://cve.now/CVE-2022-4897.md): BackupBuddy \< 8.8.3 - Multiple Reflected Cross-Site Scripting (CVSS 6.1, BackupBuddy)
- [CVE-2022-4784](https://cve.now/CVE-2022-4784.md): Hueman Addons \<= 2.3.3 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Hueman Addons)
- [CVE-2023-0372](https://cve.now/CVE-2023-0372.md): EmbedStories \< 0.7.5 - Contributor+ Stored XSS (CVSS 5.4, EmbedStories)
- [CVE-2022-4622](https://cve.now/CVE-2022-4622.md): Login Logout Menu \<= 1.3.3 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, Login Logout Menu)
- [CVE-2023-0492](https://cve.now/CVE-2023-0492.md): GS Products Slider for WooCommerce \< 1.5.9 - Contributor+ Stored XSS (CVSS 5.4, GS Products Slider for WooCommerce)
- [CVE-2023-0559](https://cve.now/CVE-2023-0559.md): GS Portfolio for Envato \< 1.4.0 - Contributor+ Stored XSS (CVSS 5.4, GS Portfolio for Envato)
- [CVE-2022-4785](https://cve.now/CVE-2022-4785.md): Download Video Sidebar Widgets \<= 6.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Video Sidebar Widgets)
- [CVE-2022-4750](https://cve.now/CVE-2022-4750.md): WP Responsive Testimonials Slider And Widget \<= 1.5 - Contributor+ Stored XSS (CVSS 5.4, WP Responsive Testimonials Slider And Widget)
- [CVE-2022-4761](https://cve.now/CVE-2022-4761.md): Post Views Count \<= 3.0.2 - Contributor+ Stored XSS in Shortcode (CVSS 6.8, Post Views Count)
- [CVE-2023-0378](https://cve.now/CVE-2023-0378.md): Greenshift \< 5.0 - Contributor+ Stored XSS (CVSS 6.8, Greenshift)
- [CVE-2023-0285](https://cve.now/CVE-2023-0285.md): Real Media Library \< 4.18.29 - Author+ Stored XSS (no CVSS, Real Media Library: Media Library Folder & File Manager)
- [CVE-2022-4777](https://cve.now/CVE-2022-4777.md): Bootstrap Shortcodes \<= 3.4.0 - Contributor+ Stored XSS via Shortcode (no CVSS, Bootstrap Shortcodes)
- [CVE-2023-0067](https://cve.now/CVE-2023-0067.md): Timed Content \< 2.73 - Contributor+ Stored XSS (no CVSS, Timed Content)
- [CVE-2022-4385](https://cve.now/CVE-2022-4385.md): Intuitive Custom Post Order \< 3.1.4 - Subscriber+ Arbitrary Menu Order Update (no CVSS, Intuitive Custom Post Order)
- [CVE-2022-4669](https://cve.now/CVE-2022-4669.md): Page Builder: Live Composer \< 1.5.23 - Contributor+ Stored XSS via Shortcode (no CVSS, Page Builder: Live Composer)
- [CVE-2023-0231](https://cve.now/CVE-2023-0231.md): ShopLentor \< 2.5.4 - Contributor+ Stored XSS (no CVSS, ShopLentor)
- [CVE-2023-0375](https://cve.now/CVE-2023-0375.md): Easy Affiliate Links \< 3.7.1 - Contributor+ Stored XSS (CVSS 6.8, Easy Affiliate Links)
- [CVE-2020-36656](https://cve.now/CVE-2020-36656.md): Spectra \< 1.15.0 - Contributor+ Stored Cross-Side Scripting (CVSS 5.4, Spectra)
- [CVE-2023-0271](https://cve.now/CVE-2023-0271.md): WP Font Awesome \< 1.7.9 - Contributor+ Stored XSS (CVSS 5.4, WP Font Awesome)
- [CVE-2023-0380](https://cve.now/CVE-2023-0380.md): Easy Digital Downloads \< 3.1.0.5 - Contributor+ Stored XSS (CVSS 5.4, Easy Digital Downloads)
- [CVE-2015-10082](https://cve.now/CVE-2015-10082.md): UIKit0 libplist XML xplist.c plist\_from\_xml xml external entity reference (CVSS 5.5, UIKit0 libplist)
- [CVE-2023-24575](https://cve.now/CVE-2023-24575.md): Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnera (CVSS 7.8, Dell Multifunction Printer E525w Driver and Software Suite)
- [CVE-2014-125089](https://cve.now/CVE-2014-125089.md): cention-chatserver InternalChatProtocol.fe \_formatBody cross site scripting (CVSS 3.5, cention-chatserver)
- [CVE-2022-31394](https://cve.now/CVE-2022-31394.md): Hyperium Hyper before 0.14.19 does not allow for customization of the max\_header\_list\_size method in the H2 third-party software, allowing a (CVSS 7.5)
- [CVE-2022-38779](https://cve.now/CVE-2022-38779.md): An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously (no CVSS, Elastic kibana)
- [CVE-2022-45564](https://cve.now/CVE-2022-45564.md): SQL Injection vulnerability in znfit Home improvement ERP management system V50\_20220207,v42 allows attackers to execute arbitrary sql comma (CVSS 9.8)
- [CVE-2022-45677](https://cve.now/CVE-2022-45677.md): SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student\_login.process.php. (CVSS 9.8)
- [CVE-2022-46637](https://cve.now/CVE-2022-46637.md): Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services. (CVSS 9.8)
- [CVE-2022-48340](https://cve.now/CVE-2022-48340.md): In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht\_setxattr\_mds\_cbk use-after-free. (CVSS 7.5)
- [CVE-2023-0934](https://cve.now/CVE-2023-0934.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 6.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-20855](https://cve.now/CVE-2023-20855.md): VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. (CVSS 8.8, VMware vRealize Orchestrator, VMware vRealize Automation, V…)
- [CVE-2023-20858](https://cve.now/CVE-2023-20858.md): VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. (CVSS 7.2, VMware Carbon Black App Control)
- [CVE-2023-22920](https://cve.now/CVE-2023-22920.md): A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconf (CVSS 9.8, Zyxel LTE3316-M604)
- [CVE-2023-22984](https://cve.now/CVE-2023-22984.md): A Vulnerability was discovered in Axis 207W network camera. (no CVSS)
- [CVE-2023-23009](https://cve.now/CVE-2023-23009.md): Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorr (CVSS 6.5)
- [CVE-2023-24080](https://cve.now/CVE-2023-24080.md): A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accoun (CVSS 9.8)
- [CVE-2023-24081](https://cve.now/CVE-2023-24081.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attackers to execute arbi (CVSS 5.4)
- [CVE-2023-24184](https://cve.now/CVE-2023-24184.md): TOTOLink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability. (CVSS 9.8)
- [CVE-2023-24320](https://cve.now/CVE-2023-24320.md): An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors. (CVSS 9.8)
- [CVE-2023-26242](https://cve.now/CVE-2023-26242.md): afu\_mmio\_region\_get\_by\_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow. (CVSS 7.8)
- [CVE-2023-26249](https://cve.now/CVE-2023-26249.md): Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of s (CVSS 7.5)
- [CVE-2023-26253](https://cve.now/CVE-2023-26253.md): In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. (CVSS 7.5)
- [CVE-2023-26265](https://cve.now/CVE-2023-26265.md): The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. (CVSS 5.3)
- [CVE-2023-26266](https://cve.now/CVE-2023-26266.md): In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code exe (CVSS 7.3)
- [CVE-2023-26267](https://cve.now/CVE-2023-26267.md): php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities w (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.