# CVEs published 2023-03-13

82 CVEs were published on March 13, 2023: 15 critical, 30 high. Days are UTC.

- [CVE-2023-27582](https://cve.now/CVE-2023-27582.md): Full authentication bypass if SASL authorization username is specified (CVSS 9.1, foxcpp maddy · github.com/foxcpp/maddy)
- [CVE-2023-27583](https://cve.now/CVE-2023-27583.md): Panindex uses hard coded cyptographic key (CVSS 9.8, px-org PanIndex)
- [CVE-2023-0345](https://cve.now/CVE-2023-0345.md): CVE-2023-0345 (CVSS 9.8, Akuvox E11)
- [CVE-2023-0346](https://cve.now/CVE-2023-0346.md): CVE-2023-0346 (CVSS 7.5, Akuvox E11)
- [CVE-2023-0347](https://cve.now/CVE-2023-0347.md): CVE-2023-0347 (CVSS 7.5, Akuvox E11)
- [CVE-2023-0348](https://cve.now/CVE-2023-0348.md): CVE-2023-0348 (CVSS 7.5, Akuvox E11)
- [CVE-2023-0349](https://cve.now/CVE-2023-0349.md): CVE-2023-0349 (CVSS 7.5, Akuvox E11)
- [CVE-2023-0350](https://cve.now/CVE-2023-0350.md): CVE-2023-0350 (CVSS 6.5, Akuvox E11)
- [CVE-2023-0351](https://cve.now/CVE-2023-0351.md): CVE-2023-0351 (CVSS 8.8, Akuvox E11)
- [CVE-2023-27581](https://cve.now/CVE-2023-27581.md): github-slug-action vulnerable to arbitrary code execution (CVSS 8.8, rlespinasse github-slug-action)
- [CVE-2023-0352](https://cve.now/CVE-2023-0352.md): CVE-2023-0352 (CVSS 9.1, Akuvox E11)
- [CVE-2023-0353](https://cve.now/CVE-2023-0353.md): CVE-2023-0353 (CVSS 7.2, Akuvox E11)
- [CVE-2023-0354](https://cve.now/CVE-2023-0354.md): CVE-2023-0354 (CVSS 9.1, Akuvox E11)
- [CVE-2023-0355](https://cve.now/CVE-2023-0355.md): CVE-2023-0355 (CVSS 6.5, Akuvok E11)
- [CVE-2023-25802](https://cve.now/CVE-2023-25802.md): Roxy-WI has Path Traversal vulnerability (CVSS 7.5, hap-wi roxy-wi)
- [CVE-2023-1378](https://cve.now/CVE-2023-1378.md): SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter paypalsuccess.php sql injection (CVSS 6.3, SourceCodester Friendly Island Pizza Website and Ordering S…)
- [CVE-2023-27580](https://cve.now/CVE-2023-27580.md): CodeIgniter Shield Password Shucking Vulnerability (CVSS 7.5, codeigniter4 shield · codeigniter4/shield)
- [CVE-2023-0973](https://cve.now/CVE-2023-0973.md): Step Tools Third-Party (CVSS 2.2, Step Tools v18SP1 ifcmesh library)
- [CVE-2023-25170](https://cve.now/CVE-2023-25170.md): PrestaShop has possible CSRF token fixation (CVSS 5.0, PrestaShop · prestashop/prestashop)
- [CVE-2022-4466](https://cve.now/CVE-2022-4466.md): WordPress Infinite Scroll - Ajax Load More \< 5.6.0.3 - Contributor+ Stored XSS (no CVSS, WordPress Infinite Scroll)
- [CVE-2023-0073](https://cve.now/CVE-2023-0073.md): Client Logo Carousel \<= 3.0.0 - Contributor+ Stored XSS (no CVSS, Client Logo Carousel)
- [CVE-2023-0219](https://cve.now/CVE-2023-0219.md): FluentSMTP \< 2.2.3 - Stored XSS via Email Logs (no CVSS, FluentSMTP)
- [CVE-2023-0844](https://cve.now/CVE-2023-0844.md): Namaste! LMS \< 2.6 - Admin+ Stored XSS (no CVSS, Namaste! LMS)
- [CVE-2022-4661](https://cve.now/CVE-2022-4661.md): Woo Products Widgets For Elementor \< 1.0.8 - Contributor+ Stored XSS via Shortcode (no CVSS, Widgets for WooCommerce Products on Elementor)
- [CVE-2023-0538](https://cve.now/CVE-2023-0538.md): Campaign URL Builder \< 1.8.2 - Contributor+ Stored XSS (no CVSS, Campaign URL Builder)
- [CVE-2023-0172](https://cve.now/CVE-2023-0172.md): Juicer \< 1.11 - Contributor+ Stored XSS (no CVSS, Embed, curate & aggregate social media feeds into your webs…)
- [CVE-2023-0037](https://cve.now/CVE-2023-0037.md): 10WebMapBuilder \< 1.0.73 - Unauthenticated SQLi (CVSS 9.8, 10Web Map Builder for Google Maps)
- [CVE-2023-0749](https://cve.now/CVE-2023-0749.md): Ocean Extra \< 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure (CVSS 6.5, Ocean Extra)
- [CVE-2023-0772](https://cve.now/CVE-2023-0772.md): Popup Builder by OptinMonster \< 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure (CVSS 6.5, Popup Builder by OptinMonster)
- [CVE-2022-4652](https://cve.now/CVE-2022-4652.md): Video Background \< 2.7.5 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Video Background)
- [CVE-2023-0066](https://cve.now/CVE-2023-0066.md): Companion Sitemap Generator \<= 4.5.1.1 - Contributor+ Stored XSS (CVSS 5.4, Companion Sitemap Generator)
- [CVE-2023-0477](https://cve.now/CVE-2023-0477.md): Auto Featured Image \< 3.9.16 - Author+ Arbitrary File Upload (no CVSS, Auto Featured Image)
- [CVE-2023-25973](https://cve.now/CVE-2023-25973.md): WordPress Auto Affiliate Links Plugin \<= 6.3.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Lucian Apostol Auto Affiliate Links)
- [CVE-2023-23711](https://cve.now/CVE-2023-23711.md): WordPress A2 Optimized WP Plugin \<= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, A2 Hosting A2 Optimized WP)
- [CVE-2023-22700](https://cve.now/CVE-2023-22700.md): WordPress PixelYourSite – Your smart PIXEL (TAG) Manager Plugin \<= 9.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, PixelYourSite – Your smart PIXEL (TAG) Manager)
- [CVE-2023-25991](https://cve.now/CVE-2023-25991.md): WordPress RegistrationMagic Plugin \<= 5.1.9.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, RegistrationMagic)
- [CVE-2022-38074](https://cve.now/CVE-2022-38074.md): WordPress WP Statistics Plugin \<= 13.2.10 is vulnerable to SQL Injection (CVSS 9.9, VeronaLabs WP Statistics)
- [CVE-2023-0978](https://cve.now/CVE-2023-0978.md): A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute (CVSS 6.4, Trellix Intelligent Sandbox)
- [CVE-2022-31474](https://cve.now/CVE-2022-31474.md): WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal (CVSS 7.5, iThemes BackupBuddy)
- [CVE-2023-1374](https://cve.now/CVE-2023-1374.md): Solidres \<= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, Solidres – Hotel booking plugin for WordPress)
- [CVE-2023-1372](https://cve.now/CVE-2023-1372.md): WH Testimonials \<= 3.0.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, webhostings WH Testimonials)
- [CVE-2023-0629](https://cve.now/CVE-2023-0629.md): Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers (CVSS 7.1, Docker Desktop)
- [CVE-2023-0628](https://cve.now/CVE-2023-0628.md): Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL (CVSS 6.1, Docker Desktop)
- [CVE-2022-47440](https://cve.now/CVE-2022-47440.md): WordPress My Tickets Plugin \<= 1.9.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Joseph C Dolson My Tickets)
- [CVE-2022-47166](https://cve.now/CVE-2022-47166.md): WordPress Void Contact Form 7 Widget For Elementor Page Builder Plugin \<= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, voidCoders Void Contact Form 7 Widget For Elementor Page Bu…)
- [CVE-2023-1370](https://cve.now/CVE-2023-1370.md): Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON (CVSS 7.5, json-smart · net.minidev:json-smart)
- [CVE-2023-1369](https://cve.now/CVE-2023-1369.md): TG Soft Vir.IT eXplorer IoControlCode VIRAGTLT.sys 0x82730088 denial of service (CVSS 5.0, TG Soft Vir.IT eXplorer)
- [CVE-2023-1368](https://cve.now/CVE-2023-1368.md): XHCMS POST Parameter login.php sql injection (CVSS 7.3, XHCMS)
- [CVE-2023-1366](https://cve.now/CVE-2023-1366.md): SourceCodester Yoga Class Registration System manage\_category.php query sql injection (CVSS 6.3, SourceCodester Yoga Class Registration System)
- [CVE-2023-0888](https://cve.now/CVE-2023-0888.md): Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi (CVSS 4.9, B. Braun Space Battery Pack SP with Wi-Fi)
- [CVE-2023-1365](https://cve.now/CVE-2023-1365.md): SourceCodester Online Pizza Ordering System ajax.php sql injection (CVSS 7.3, SourceCodester Online Pizza Ordering System)
- [CVE-2023-1364](https://cve.now/CVE-2023-1364.md): SourceCodester Online Pizza Ordering System GET Parameter category.php sql injection (CVSS 6.3, SourceCodester Online Pizza Ordering System)
- [CVE-2023-1363](https://cve.now/CVE-2023-1363.md): SourceCodester Computer Parts Sales and Inventory System Add User Account cross site scripting (CVSS 3.5, SourceCodester Computer Parts Sales and Inventory System)
- [CVE-2021-45423](https://cve.now/CVE-2021-45423.md): A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe\_exports function from exports.c.. (CVSS 9.8)
- [CVE-2022-2258](https://cve.now/CVE-2022-2258.md): In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these (CVSS 4.3, Octopus Deploy Octopus Server)
- [CVE-2022-2259](https://cve.now/CVE-2022-2259.md): In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view t (CVSS 4.3, Octopus Deploy Octopus Server)
- [CVE-2023-1361](https://cve.now/CVE-2023-1361.md): SQL Injection in unilogies/bumsys (CVSS 7.2, unilogies/bumsys)
- [CVE-2023-1362](https://cve.now/CVE-2023-1362.md): Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys (CVSS 8.4, unilogies/bumsys)
- [CVE-2023-1367](https://cve.now/CVE-2023-1367.md): Code Injection in alextselegidis/easyappointments (CVSS 6.0, alextselegidis/easyappointments)
- [CVE-2023-24033](https://cve.now/CVE-2023-24033.md): The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly chec (CVSS 7.5)
- [CVE-2023-24577](https://cve.now/CVE-2023-24577.md): McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. (CVSS 5.5)
- [CVE-2023-24578](https://cve.now/CVE-2023-24578.md): McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. (CVSS 5.5)
- [CVE-2023-24579](https://cve.now/CVE-2023-24579.md): McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt. (CVSS 7.8)
- [CVE-2023-24762](https://cve.now/CVE-2023-24762.md): OS Command injection vulnerability in D-Link DIR-867 DIR\_867\_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPA (CVSS 9.8)
- [CVE-2023-25207](https://cve.now/CVE-2023-25207.md): PrestaShop dpdfrance \<6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. (CVSS 9.8)
- [CVE-2023-25279](https://cve.now/CVE-2023-25279.md): OS Command injection vulnerability in D-Link DIR820LA1\_FW105B03 allows attackers to escalate privileges to root via a crafted payload. (CVSS 9.8)
- [CVE-2023-25283](https://cve.now/CVE-2023-25283.md): A stack overflow vulnerability in D-Link DIR820LA1\_FW106B02 allows attackers to cause a denial of service via the reserveDHCP\_HostName\_1.1.1 (CVSS 7.5)
- [CVE-2023-25803](https://cve.now/CVE-2023-25803.md): Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. (CVSS 7.5, hap-wi roxy-wi)
- [CVE-2023-26072](https://cve.now/CVE-2023-26072.md): An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22 (CVSS 7.6)
- [CVE-2023-26073](https://cve.now/CVE-2023-26073.md): An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22 (CVSS 7.6)
- [CVE-2023-26074](https://cve.now/CVE-2023-26074.md): An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22 (CVSS 7.6)
- [CVE-2023-26076](https://cve.now/CVE-2023-26076.md): An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5 (CVSS 7.6)
- [CVE-2023-27010](https://cve.now/CVE-2023-27010.md): Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. (CVSS 7.8)
- [CVE-2023-27052](https://cve.now/CVE-2023-27052.md): E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete\_user.php. (CVSS 9.8)
- [CVE-2023-27061](https://cve.now/CVE-2023-27061.md): Tenda V15V1.0 V15.11.0.14(1521\_3190\_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter i (CVSS 9.8)
- [CVE-2023-27062](https://cve.now/CVE-2023-27062.md): Tenda V15V1.0 was discovered to contain a buffer overflow vulnerability via the gotoUrl parameter in the formPortalAuth function. (CVSS 7.5)
- [CVE-2023-27063](https://cve.now/CVE-2023-27063.md): Tenda V15V1.0 V15.11.0.14(1521\_3190\_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the f (CVSS 9.8)
- [CVE-2023-27064](https://cve.now/CVE-2023-27064.md): Tenda V15V1.0 V15.11.0.14(1521\_3190\_1058) was discovered to contain a buffer overflow vulnerability via the index parameter in the formDelDn (CVSS 7.5)
- [CVE-2023-27065](https://cve.now/CVE-2023-27065.md): Tenda V15V1.0 V15.11.0.14(1521\_3190\_1058) was discovered to contain a buffer overflow vulnerability via the picName parameter in the formDel (CVSS 7.5)
- [CVE-2023-27093](https://cve.now/CVE-2023-27093.md): Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function. (CVSS 6.1)
- [CVE-2023-27587](https://cve.now/CVE-2023-27587.md): ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive informatio (CVSS 7.4, rozbb readtomyshoe)
- [CVE-2023-28154](https://cve.now/CVE-2023-28154.md): Webpack 5 before 5.76.0 does not avoid cross-realm object access. (CVSS 9.8, webpack)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.