# CVEs published 2023-03-05

26 CVEs were published on March 5, 2023: 0 critical, 3 high. Days are UTC.

- [CVE-2015-10090](https://cve.now/CVE-2015-10090.md): Landing Pages Plugin cross site scripting (CVSS 3.5, Landing Pages Plugin)
- [CVE-2014-125092](https://cve.now/CVE-2014-125092.md): MaxButtons Plugin maxbuttons-button.php maxbuttons\_strip\_px cross site scripting (CVSS 3.5, MaxButtons Plugin)
- [CVE-2006-10001](https://cve.now/CVE-2006-10001.md): Subscribe to Comments Plugin subscribe-to-comments.php cross site scripting (CVSS 3.5, Subscribe to Comments Plugin)
- [CVE-2022-4927](https://cve.now/CVE-2022-4927.md): ualbertalib NEOSDiscovery \_refworks.html.erb reverse tabnabbing (CVSS 5.5, ualbertalib NEOSDiscovery)
- [CVE-2021-4329](https://cve.now/CVE-2021-4329.md): json-logic-js logic.js command injection (CVSS 5.5, json-logic-js)
- [CVE-2015-10089](https://cve.now/CVE-2015-10089.md): flame.js cross site scripting (CVSS 3.5, flame.js)
- [CVE-2023-1180](https://cve.now/CVE-2023-1180.md): SourceCodester Health Center Patient Record Management System hematology\_print.php cross site scripting (CVSS 3.5, SourceCodester Health Center Patient Record Management Syst…)
- [CVE-2023-1179](https://cve.now/CVE-2023-1179.md): SourceCodester Computer Parts Sales and Inventory System Add Supplier cross site scripting (CVSS 3.5, SourceCodester Computer Parts Sales and Inventory System)
- [CVE-2015-10088](https://cve.now/CVE-2015-10088.md): ayttm proxy.c http\_connect format string (CVSS 5.0, ayttm)
- [CVE-2008-10003](https://cve.now/CVE-2008-10003.md): iGamingModules flashgames game.php sql injection (CVSS 6.3, iGamingModules flashgames)
- [CVE-2008-10002](https://cve.now/CVE-2008-10002.md): cfire24 ajaxlife cross site scripting (CVSS 3.5, cfire24 ajaxlife)
- [CVE-2023-0734](https://cve.now/CVE-2023-0734.md): Improper Authorization in wallabag/wallabag (CVSS 7.3, wallabag/wallabag)
- [CVE-2023-1181](https://cve.now/CVE-2023-1181.md): Cross-site Scripting (XSS) - Stored in icret/easyimages2.0 (CVSS 5.4, icret/easyimages2.0)
- [CVE-2023-22335](https://cve.now/CVE-2023-22335.md): Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote att (no CVSS, DOS Co. SS1 and Rakuraku PC Cloud)
- [CVE-2023-22336](https://cve.now/CVE-2023-22336.md): Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to (no CVSS, DOS Co. SS1 and Rakuraku PC Cloud)
- [CVE-2023-22344](https://cve.now/CVE-2023-22344.md): Use of hard-coded credentials vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remo (no CVSS, DOS Co. SS1 and Rakuraku PC Cloud)
- [CVE-2023-22419](https://cve.now/CVE-2023-22419.md): Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and (no CVSS, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2023-22421](https://cve.now/CVE-2023-22421.md): Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and (CVSS 7.8, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2023-22424](https://cve.now/CVE-2023-22424.md): Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earl (CVSS 7.8, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2023-22432](https://cve.now/CVE-2023-22432.md): Open redirect vulnerability exists in web2py versions prior to 2.23.1. (CVSS 6.1, web2py)
- [CVE-2023-22438](https://cve.now/CVE-2023-22438.md): Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC- (CVSS 5.4, EC-CUBE CO. EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE…)
- [CVE-2023-22838](https://cve.now/CVE-2023-22838.md): Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, (no CVSS, EC-CUBE CO. EC-CUBE 4 series)
- [CVE-2023-25077](https://cve.now/CVE-2023-25077.md): Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 (no CVSS, EC-CUBE CO. EC-CUBE 4 series)
- [CVE-2023-26510](https://cve.now/CVE-2023-26510.md): Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security p (no CVSS)
- [CVE-2023-27635](https://cve.now/CVE-2023-27635.md): debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (no CVSS)
- [CVE-2023-27641](https://cve.now/CVE-2023-27641.md): The REPORT (after z but before a) parameter in wa.exe in L-Soft LISTSERV 16.5 before 17 allows an attacker to conduct XSS attacks via a craf (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.