# CVEs published 2023-02-27

145 CVEs were published on February 27, 2023: 10 critical, 36 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-26043](https://cve.now/CVE-2023-26043.md): XML External Entity (XXE) injection in GeoServer style upload functionality (CVSS 6.5, geonode)
- [CVE-2023-26041](https://cve.now/CVE-2023-26041.md): Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured (CVSS 2.6, nextcloud security-advisories)
- [CVE-2023-0331](https://cve.now/CVE-2023-0331.md): Correos Oficial \<= 1.2.0.2 - Unauthenticated Arbitrary File Download (CVSS 7.5, Correos Oficial)
- [CVE-2023-0043](https://cve.now/CVE-2023-0043.md): Custom Add User \<= 2.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, Custom Add User)
- [CVE-2023-0278](https://cve.now/CVE-2023-0278.md): GeoDirectory \< 2.2.24 - Admin+ SQLi (CVSS 7.2, GeoDirectory)
- [CVE-2023-0487](https://cve.now/CVE-2023-0487.md): My Sticky Elements \< 2.0.9 - Admin+ SQLi (CVSS 7.2, All-in-one Floating Contact Form, Call, Chat, and 50+ Socia…)
- [CVE-2023-0279](https://cve.now/CVE-2023-0279.md): Media Library Assistant \< 3.06 - Admin+ SQLi (CVSS 7.2, Media Library Assistant)
- [CVE-2023-0535](https://cve.now/CVE-2023-0535.md): Donation Block For PayPal \< 2.1.0 - Contributor+ Stored XSS (CVSS 5.4, Donation Block For PayPal)
- [CVE-2022-4679](https://cve.now/CVE-2022-4679.md): Wufoo Shortcode \< 1.52 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Wufoo Shortcode)
- [CVE-2022-4550](https://cve.now/CVE-2022-4550.md): User Activity \<= 1.0.1 - IP Spoofing (CVSS 7.5, User Activity)
- [CVE-2023-0539](https://cve.now/CVE-2023-0539.md): GS Insever Portfolio \< 1.4.5 - Contributor+ Stored XSS (no CVSS, GS Insever Portfolio)
- [CVE-2022-4788](https://cve.now/CVE-2022-4788.md): Embed PDF \<= 1.0.6 - Contributor+ Stored XSS via Shortcode (no CVSS, Embed PDF)
- [CVE-2023-0543](https://cve.now/CVE-2023-0543.md): Arigato Autoresponder and Newsletter \< 2.1.7.2 - Admin+ Stored XSS (CVSS 4.8, Arigato Autoresponder and Newsletter)
- [CVE-2023-0168](https://cve.now/CVE-2023-0168.md): Olevmedia Shortcodes \<= 1.1.9 - Contributor+ Stored XSS (CVSS 5.4, Olevmedia Shortcodes)
- [CVE-2023-0381](https://cve.now/CVE-2023-0381.md): GigPress \<= 2.3.28 - Subscriber+ SQLi (CVSS 8.8, GigPress)
- [CVE-2023-0552](https://cve.now/CVE-2023-0552.md): Pie Register \< 3.8.2.3 - Open Redirect (CVSS 5.4, Registration Forms)
- [CVE-2022-4757](https://cve.now/CVE-2022-4757.md): List Pages Shortcode \< 1.7.6 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, List Pages Shortcode)
- [CVE-2022-4829](https://cve.now/CVE-2022-4829.md): Show-Hide / Collapse-Expand \< 1.3.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Show-Hide / Collapse-Expand)
- [CVE-2023-0548](https://cve.now/CVE-2023-0548.md): Namaste! LMS \< 2.5.9.4 - Admin+ Stored XSS (CVSS 4.8, Namaste! LMS)
- [CVE-2022-4795](https://cve.now/CVE-2022-4795.md): Galleries by Angie Makes \<= 1.67 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Galleries by Angie Makes)
- [CVE-2023-0230](https://cve.now/CVE-2023-0230.md): VK All in One Expansion Unit \< 9.86.0.0 - Contributor+ Stored XSS (CVSS 5.4, VK All in One Expansion Unit)
- [CVE-2023-0334](https://cve.now/CVE-2023-0334.md): ShortPixel Adaptive Images \< 3.6.3 - Reflected XSS (CVSS 6.1, ShortPixel Adaptive Images)
- [CVE-2023-27266](https://cve.now/CVE-2023-27266.md): Disclosure of team owner email address when when accessing the teams API (CVSS 2.7, Mattermost)
- [CVE-2023-27265](https://cve.now/CVE-2023-27265.md): Disclosure of team owner email address when regenerating Invite ID (CVSS 2.7, Mattermost)
- [CVE-2023-27264](https://cve.now/CVE-2023-27264.md): IDOR: Updating a playbook via the Playbooks API (CVSS 7.1, Mattermost)
- [CVE-2023-27263](https://cve.now/CVE-2023-27263.md): IDOR: Accessing playbook runs via the Playbooks Runs API (CVSS 4.3, Mattermost)
- [CVE-2023-26042](https://cve.now/CVE-2023-26042.md): HTML/XSS injection possibilities in Part-DB (CVSS 6.1, Part-DB-server)
- [CVE-2022-45140](https://cve.now/CVE-2022-45140.md): WAGO: Missing Authentication for Critical Function (CVSS 9.8, WAGO Compact Controller CC100 · WAGO Edge Controller +5)
- [CVE-2022-45139](https://cve.now/CVE-2022-45139.md): WAGO: Origin validation error through CORS misconfiguration (CVSS 5.3, WAGO Compact Controller CC100 · WAGO Edge Controller +5)
- [CVE-2022-45138](https://cve.now/CVE-2022-45138.md): WAGO: Missing Authentication for Critical Function (CVSS 9.8, WAGO Compact Controller CC100 · WAGO Edge Controller +5)
- [CVE-2022-45137](https://cve.now/CVE-2022-45137.md): WAGO: Reflective Cross-Site Scripting (CVSS 6.1, WAGO Compact Controller CC100 · WAGO Edge Controller +5)
- [CVE-2023-22860](https://cve.now/CVE-2023-22860.md): IBM Cloud Pak for Business Automation cross-site scripting (CVSS 5.4, IBM Cloud Pak for Business Automation)
- [CVE-2022-40237](https://cve.now/CVE-2022-40237.md): IBM MQ for HPE NonStop denial of service (CVSS 6.5, IBM MQ for HPE NonStop)
- [CVE-2023-1068](https://cve.now/CVE-2023-1068.md): Download Read More Excerpt Link \<= 1.6.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, teckel Read More Excerpt Link)
- [CVE-2023-1063](https://cve.now/CVE-2023-1063.md): SourceCodester Doctors Appointment System Parameter patient.php sql injection (CVSS 6.3, SourceCodester Doctors Appointment System)
- [CVE-2023-1062](https://cve.now/CVE-2023-1062.md): SourceCodester Doctors Appointment System Parameter add-new.php sql injection (CVSS 6.3, SourceCodester Doctors Appointment System)
- [CVE-2023-1061](https://cve.now/CVE-2023-1061.md): SourceCodester Doctors Appointment System edit-doc.php sql injection (CVSS 5.3, SourceCodester Doctors Appointment System)
- [CVE-2023-1059](https://cve.now/CVE-2023-1059.md): SourceCodester Doctors Appointment System Parameter doctors.php sql injection (CVSS 5.3, SourceCodester Doctors Appointment System)
- [CVE-2023-1058](https://cve.now/CVE-2023-1058.md): SourceCodester Doctors Appointment System create-account.php sql injection (CVSS 7.3, SourceCodester Doctors Appointment System)
- [CVE-2023-1057](https://cve.now/CVE-2023-1057.md): SourceCodester Doctors Appointment System login.php edoc sql injection (CVSS 5.5, SourceCodester Doctors Appointment System)
- [CVE-2023-1056](https://cve.now/CVE-2023-1056.md): SourceCodester Doctors Appointment System patient.php sql injection (CVSS 6.3, SourceCodester Doctors Appointment System)
- [CVE-2023-1054](https://cve.now/CVE-2023-1054.md): SourceCodester Music Gallery Site sql injection (CVSS 4.7, SourceCodester Music Gallery Site)
- [CVE-2023-1053](https://cve.now/CVE-2023-1053.md): SourceCodester Music Gallery Site view\_category.php sql injection (CVSS 4.7, SourceCodester Music Gallery Site)
- [CVE-2023-22636](https://cve.now/CVE-2023-22636.md): An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow (CVSS 6.6, Fortinet FortiWeb)
- [CVE-2020-9846](https://cve.now/CVE-2020-9846.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2021-32302](https://cve.now/CVE-2021-32302.md): Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File pa (no CVSS)
- [CVE-2021-46841](https://cve.now/CVE-2021-46841.md): This issue was addressed by using HTTPS when sending information over the network. (no CVSS, Apple Music for Android)
- [CVE-2022-22582](https://cve.now/CVE-2022-22582.md): A validation issue existed in the handling of symlinks. (no CVSS, Apple macOS)
- [CVE-2022-22668](https://cve.now/CVE-2022-22668.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple macOS)
- [CVE-2022-26760](https://cve.now/CVE-2022-26760.md): A memory corruption issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-31405](https://cve.now/CVE-2022-31405.md): MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext. (no CVSS)
- [CVE-2022-32784](https://cve.now/CVE-2022-32784.md): The issue was addressed with improved UI handling. (no CVSS, Apple Safari · Apple iOS and iPadOS)
- [CVE-2022-32824](https://cve.now/CVE-2022-32824.md): The issue was addressed with improved memory handling. (no CVSS, Apple tvOS · Apple watchOS)
- [CVE-2022-32830](https://cve.now/CVE-2022-32830.md): An out-of-bounds read issue was addressed with improved bounds checking. (no CVSS, Apple tvOS)
- [CVE-2022-32836](https://cve.now/CVE-2022-32836.md): This issue was addressed with improved state management. (no CVSS, Apple Music for Android)
- [CVE-2022-32844](https://cve.now/CVE-2022-32844.md): A race condition was addressed with improved state handling. (CVSS 6.3, Apple tvOS · Apple watchOS)
- [CVE-2022-32846](https://cve.now/CVE-2022-32846.md): A logic issue was addressed with improved state management. (CVSS 7.5, Apple Music for Android)
- [CVE-2022-32855](https://cve.now/CVE-2022-32855.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-32891](https://cve.now/CVE-2022-32891.md): The issue was addressed with improved UI handling. (no CVSS, Apple iOS · Apple Safari +1)
- [CVE-2022-32896](https://cve.now/CVE-2022-32896.md): This issue was addressed by enabling hardened runtime. (no CVSS, Apple macOS)
- [CVE-2022-32900](https://cve.now/CVE-2022-32900.md): A logic issue was addressed with improved state management. (CVSS 7.8, Apple macOS)
- [CVE-2022-32902](https://cve.now/CVE-2022-32902.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2022-32906](https://cve.now/CVE-2022-32906.md): This issue was addressed with using HTTPS when sending information over the network. (CVSS 5.3, Apple Music for Android)
- [CVE-2022-32949](https://cve.now/CVE-2022-32949.md): This issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS)
- [CVE-2022-34908](https://cve.now/CVE-2022-34908.md): An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. (CVSS 8.2)
- [CVE-2022-34909](https://cve.now/CVE-2022-34909.md): An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. (CVSS 7.7)
- [CVE-2022-34910](https://cve.now/CVE-2022-34910.md): An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. (CVSS 4.1)
- [CVE-2022-42797](https://cve.now/CVE-2022-42797.md): An injection issue was addressed with improved input validation. (no CVSS, Apple Xcode)
- [CVE-2022-42826](https://cve.now/CVE-2022-42826.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2022-42833](https://cve.now/CVE-2022-42833.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2022-42838](https://cve.now/CVE-2022-42838.md): An issue with app access to camera data was addressed with improved logic. (no CVSS, Apple macOS)
- [CVE-2022-45697](https://cve.now/CVE-2022-45697.md): Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory. (no CVSS)
- [CVE-2022-46704](https://cve.now/CVE-2022-46704.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-46705](https://cve.now/CVE-2022-46705.md): A spoofing issue existed in the handling of URLs. (no CVSS, Apple macOS)
- [CVE-2022-46712](https://cve.now/CVE-2022-46712.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2022-46713](https://cve.now/CVE-2022-46713.md): A race condition was addressed with additional validation. (no CVSS, Apple macOS)
- [CVE-2022-46723](https://cve.now/CVE-2022-46723.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-48230](https://cve.now/CVE-2022-48230.md): There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. (CVSS 7.5, BiSheng-WNM)
- [CVE-2022-48254](https://cve.now/CVE-2022-48254.md): There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). (CVSS 4.6, Leia-B29)
- [CVE-2022-48255](https://cve.now/CVE-2022-48255.md): There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. (CVSS 9.8, BiSheng-WNM)
- [CVE-2022-48259](https://cve.now/CVE-2022-48259.md): There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. (CVSS 9.8, BiSheng-WNM)
- [CVE-2022-48260](https://cve.now/CVE-2022-48260.md): There is a buffer overflow vulnerability in BiSheng-WNM FW 3.0.0.325. (CVSS 7.5, BiSheng-WNM)
- [CVE-2022-48261](https://cve.now/CVE-2022-48261.md): There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. (CVSS 7.5, BiSheng-WNM)
- [CVE-2022-48283](https://cve.now/CVE-2022-48283.md): A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. (CVSS 9.8, HarmonyOS AILife Solution)
- [CVE-2022-48284](https://cve.now/CVE-2022-48284.md): A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. (CVSS 9.8, HarmonyOS AILife Solution)
- [CVE-2022-48305](https://cve.now/CVE-2022-48305.md): There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. (CVSS 5.5, Simba-AL00)
- [CVE-2023-1055](https://cve.now/CVE-2023-1055.md): A flaw was found in RHDS 11 and RHDS 12. (no CVSS, Red Hat Directory Server)
- [CVE-2023-1067](https://cve.now/CVE-2023-1067.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.2, pimcore/pimcore)
- [CVE-2023-1070](https://cve.now/CVE-2023-1070.md): External Control of File Name or Path in nilsteampassnet/teampass (CVSS 7.1, nilsteampassnet/teampass)
- [CVE-2023-23080](https://cve.now/CVE-2023-23080.md): Certain Tenda products are vulnerable to command injection. (no CVSS)
- [CVE-2023-23108](https://cve.now/CVE-2023-23108.md): In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in t (no CVSS)
- [CVE-2023-23109](https://cve.now/CVE-2023-23109.md): In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the f (no CVSS)
- [CVE-2023-23155](https://cve.now/CVE-2023-23155.md): Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the username parameter in the A (no CVSS)
- [CVE-2023-23156](https://cve.now/CVE-2023-23156.md): Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the pid parameter in the single (no CVSS)
- [CVE-2023-23157](https://cve.now/CVE-2023-23157.md): A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2023-23158](https://cve.now/CVE-2023-23158.md): A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2023-23493](https://cve.now/CVE-2023-23493.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-23496](https://cve.now/CVE-2023-23496.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple tvOS +3)
- [CVE-2023-23497](https://cve.now/CVE-2023-23497.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-23498](https://cve.now/CVE-2023-23498.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-23499](https://cve.now/CVE-2023-23499.md): This issue was addressed by enabling hardened runtime. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23500](https://cve.now/CVE-2023-23500.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23501](https://cve.now/CVE-2023-23501.md): The issue was addressed with improved memory handling This issue is fixed in macOS Ventura 13.2. (no CVSS, Apple macOS)
- [CVE-2023-23502](https://cve.now/CVE-2023-23502.md): An information disclosure issue was addressed by removing the vulnerable code. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23503](https://cve.now/CVE-2023-23503.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23504](https://cve.now/CVE-2023-23504.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23505](https://cve.now/CVE-2023-23505.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-23506](https://cve.now/CVE-2023-23506.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2023-23507](https://cve.now/CVE-2023-23507.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple macOS)
- [CVE-2023-23508](https://cve.now/CVE-2023-23508.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2023-23510](https://cve.now/CVE-2023-23510.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2023-23511](https://cve.now/CVE-2023-23511.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23512](https://cve.now/CVE-2023-23512.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23513](https://cve.now/CVE-2023-23513.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 9.8, Apple macOS)
- [CVE-2023-23514](https://cve.now/CVE-2023-23514.md): A use after free issue was addressed with improved memory management. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-23517](https://cve.now/CVE-2023-23517.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple iOS and iPadOS · Apple tvOS +3)
- [CVE-2023-23518](https://cve.now/CVE-2023-23518.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple iOS and iPadOS · Apple tvOS +3)
- [CVE-2023-23519](https://cve.now/CVE-2023-23519.md): A memory corruption issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23520](https://cve.now/CVE-2023-23520.md): A race condition was addressed with additional validation. (CVSS 5.9, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-23522](https://cve.now/CVE-2023-23522.md): A privacy issue was addressed with improved handling of temporary files. (CVSS 5.5, Apple macOS)
- [CVE-2023-23524](https://cve.now/CVE-2023-23524.md): A denial-of-service issue was addressed with improved input validation. (CVSS 7.5, Apple iOS and iPadOS · Apple watchOS +2)
- [CVE-2023-23529](https://cve.now/CVE-2023-23529.md): A type confusion issue was addressed with improved checks. (CVSS 8.8, KEV, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2023-23530](https://cve.now/CVE-2023-23530.md): The issue was addressed with improved memory handling. (CVSS 8.6, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-23531](https://cve.now/CVE-2023-23531.md): The issue was addressed with improved memory handling. (CVSS 8.6, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-24206](https://cve.now/CVE-2023-24206.md): Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function. (no CVSS)
- [CVE-2023-24249](https://cve.now/CVE-2023-24249.md): An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS, encore/laravel-admin)
- [CVE-2023-24251](https://cve.now/CVE-2023-24251.md): WangEditor v5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /dist/index.js. (no CVSS)
- [CVE-2023-24253](https://cve.now/CVE-2023-24253.md): Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability. (no CVSS)
- [CVE-2023-24258](https://cve.now/CVE-2023-24258.md): SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the \_oups parameter. (no CVSS)
- [CVE-2023-24364](https://cve.now/CVE-2023-24364.md): Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under (CVSS 8.8)
- [CVE-2023-24651](https://cve.now/CVE-2023-24651.md): Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the re (CVSS 5.4)
- [CVE-2023-24652](https://cve.now/CVE-2023-24652.md): Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter un (CVSS 8.8)
- [CVE-2023-24653](https://cve.now/CVE-2023-24653.md): Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under (CVSS 8.8)
- [CVE-2023-24654](https://cve.now/CVE-2023-24654.md): Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the (CVSS 8.8)
- [CVE-2023-24656](https://cve.now/CVE-2023-24656.md): Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under (CVSS 8.8)
- [CVE-2023-25231](https://cve.now/CVE-2023-25231.md): Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface. (CVSS 9.8)
- [CVE-2023-25233](https://cve.now/CVE-2023-25233.md): Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface. (CVSS 9.8)
- [CVE-2023-25234](https://cve.now/CVE-2023-25234.md): Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface. (CVSS 9.8)
- [CVE-2023-25235](https://cve.now/CVE-2023-25235.md): Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid. (CVSS 7.5)
- [CVE-2023-26257](https://cve.now/CVE-2023-26257.md): An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. (CVSS 7.5)
- [CVE-2023-26609](https://cve.now/CVE-2023-26609.md): ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless\_mft ap (CVSS 7.2)
- [CVE-2023-26758](https://cve.now/CVE-2023-26758.md): Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService. (CVSS 7.5)
- [CVE-2023-26759](https://cve.now/CVE-2023-26759.md): Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via calls made to the XMService component. (no CVSS)
- [CVE-2023-26760](https://cve.now/CVE-2023-26760.md): Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint. (no CVSS)
- [CVE-2023-26762](https://cve.now/CVE-2023-26762.md): Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.