# CVEs published 2023-02-25

18 CVEs were published on February 25, 2023: 3 critical, 9 high. Days are UTC.

- [CVE-2023-1035](https://cve.now/CVE-2023-1035.md): SourceCodester Clinics Patient Management System update\_user.php sql injection (CVSS 6.3, SourceCodester Clinics Patient Management System)
- [CVE-2023-26104](https://cve.now/CVE-2023-26104.md): All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes co (CVSS 7.5, lite-web-server)
- [CVE-2023-26103](https://cve.now/CVE-2023-26103.md): Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functi (CVSS 5.3, deno)
- [CVE-2023-26039](https://cve.now/CVE-2023-26039.md): ZoneMinder vulnerable to OS Command injection in daemonControl() API (CVSS 7.1, zoneminder)
- [CVE-2023-26038](https://cve.now/CVE-2023-26038.md): ZoneMinder contains Local File Inclusion vulnerability via \`web/ajax/modal.php\` (CVSS 5.4, zoneminder)
- [CVE-2023-26037](https://cve.now/CVE-2023-26037.md): ZoneMinder contains SQL Injection via report\_event\_audit (CVSS 8.9, zoneminder)
- [CVE-2023-26036](https://cve.now/CVE-2023-26036.md): ZoneMinder contains Local File Inclusion vulnerability (CVSS 8.1, zoneminder)
- [CVE-2023-26035](https://cve.now/CVE-2023-26035.md): ZoneMinder vulnerable to Missing Authorization (CVSS 7.2, zoneminder)
- [CVE-2023-26034](https://cve.now/CVE-2023-26034.md): ZoneMinder SQL Injection (CVSS 9.6, zoneminder)
- [CVE-2023-26032](https://cve.now/CVE-2023-26032.md): ZoneMinder contains SQL injection via malicious Jason Web Token (CVSS 8.9, zoneminder)
- [CVE-2023-25825](https://cve.now/CVE-2023-25825.md): ZoneMinder contains Cross-site Scripting via log viewing (CVSS 7.7, zoneminder)
- [CVE-2022-2024](https://cve.now/CVE-2022-2024.md): OS Command Injection in gogs/gogs (CVSS 9.8, gogs/gogs · gogs.io/gogs)
- [CVE-2022-48362](https://cve.now/CVE-2022-48362.md): Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadSer (CVSS 8.8)
- [CVE-2023-1033](https://cve.now/CVE-2023-1033.md): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (CVSS 6.8, froxlor/froxlor)
- [CVE-2023-1034](https://cve.now/CVE-2023-1034.md): Path Traversal: '\\..\\filename' in salesagility/suitecrm (CVSS 4.3, salesagility/suitecrm)
- [CVE-2023-26544](https://cve.now/CVE-2023-26544.md): In the Linux kernel 6.0.8, there is a use-after-free in run\_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and m (CVSS 7.8)
- [CVE-2023-26545](https://cve.now/CVE-2023-26545.md): In the Linux kernel before 6.1.13, there is a double free in net/mpls/af\_mpls.c upon an allocation failure (for registering the sysctl table (CVSS 4.7)
- [CVE-2023-26550](https://cve.now/CVE-2023-26550.md): A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON fie (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.