CVEs published March 20, 2023
61 CVEs were published on March 20, 2023: 3 critical, 13 high.
- Published
- 61
- Critical
- 3
- High
- 13
- Medium
- 36
- Low
- 1
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- SourceCodester Alphaware Simple E-Commerce System
- 3
- SourceCodester E-Commerce System
- 3
- Custom Content Shortcode
- 2
- OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- 2
- pimcore/pimcore
- 2
- WellinTech KingHistorian
- 2
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- 2
- WP Meta SEO
- 2
- WP OAuth Server
- 2
- 404like Plugin
- 1
Critical 3
- CVE-2023-27578Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission checkgalaxyproject galaxy
- CVE-2023-27586CairoSVG improperly processes SVG files loaded from external resourcesKozea CairoSVG · cairosvg
- CVE-2023-28424Soko SQL Injection vulnerabilitygentoo soko
High 13
- CVE-2012-10009404like Plugin 404Like.php checkPage sql injection404like Plugin
- CVE-2022-43663An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05.WellinTech KingHistorian
- CVE-2022-45124An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05.WellinTech KingHistorian
- CVE-2023-0340Custom Content Shortcode <= 4.0.2 - Contributor+ LFICustom Content Shortcode
- CVE-2023-0875WP Meta SEO < 4.5.3 - Subscriber+ SQLiWP Meta SEO
- CVE-2023-0940ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password ResetProfileGrid
- CVE-2023-28118kaml has potential denial of service while parsing input with anchors and aliases charleskorn kaml · com.charleskorn.kaml:kaml
- CVE-2023-28083Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE Integrated Lights-Out
- CVE-2023-26513Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoSApache Software Foundation Apache Sling Resource Merger · o…
- CVE-2022-47591WordPress Map Multi Marker Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)Mickael Austoni Map Multi Marker
- CVE-2022-47592WordPress MagicForm Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)Dmytriy.cooperman MagicForm
- CVE-2023-22682WordPress Camera slideshow Plugin <= 1.4.0.1 is vulnerable to Cross Site Scripting (XSS)Manuel Masia | Pixedelic.com Camera slideshow
- CVE-2023-1250Code execution through ACL creationOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
Medium, low and unrated 45
- CVE-2023-28425Specially crafted MSETNX command can lead to denial-of-serviceredis
- CVE-2023-0681Rapid7 Nexpose Uncontrolled URL RedirectRapid7 Nexpose
- CVE-2023-0911Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta DisclosureWordPress Shortcodes Plugin — Shortcodes Ultimate
- CVE-2023-0273Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSSCustom Content Shortcode
- CVE-2022-4148WP OAuth Server < 4.3.0 - Subscriber+ Arbitrary Client DeletionWP OAuth Server
- CVE-2023-0370WPB Advanced FAQ <= 1.0.6 - Contributor+ Stored XSSWPB Advanced FAQ
- CVE-2023-0937VK All in One Expansion Unit < 9.87.1.0 - Reflected XSSVK All in One Expansion Unit
- CVE-2023-0167GetResponse for WordPress <= 5.5.31 - Contributor+ Stored XSSGetResponse for WordPress
- CVE-2023-0890Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post AccessWordPress Shortcodes Plugin — Shortcodes Ultimate
- CVE-2023-0865WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDORWooCommerce Multiple Customer Addresses & Shipping
- CVE-2023-0364real.Kit < 5.1.1 - Contributor+ Stored XSSreal.Kit
- CVE-2023-0630Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL InjectionSlimstat Analytics
- CVE-2023-0145Saan World Clock <= 1.8 - Contributor+ Stored XSSSaan World Clock
- CVE-2023-0369GoToWP <= 5.1.1 - Contributor+ Stored XSSGoToWP
- CVE-2023-0631Paid Memberships Pro < 2.9.12 - Subscriber+ SQL InjectionPaid Memberships Pro
- CVE-2023-0365React Webcam <= 1.2.0 - Contributor+ Stored XSSReact Webcam
- CVE-2023-0175Smart Logo Showcase Lite <= 1.1.9 - Contributor+ Stored XSSResponsive Clients Logo Gallery Plugin for WordPress
- CVE-2023-0876WP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary RedirectWP Meta SEO
- CVE-2022-3894WP OAuth Server < 4.2.5 - Arbitrary Post Deletion via CSRFWP OAuth Server
- CVE-2023-22288Email HTML InjectionTribe29 Checkmk
- CVE-2023-28429Pimcore has Cross-site Scripting vulnerability in DataObject tooltip fieldpimcore · pimcore/pimcore
- CVE-2023-28428PDFio vulnerable to Denial Of Service when opening a corrupt PDF filemichaelrsweet pdfio
- CVE-2023-0320XSS in UBYSIzmir Katip Celebi University UBYS
- CVE-2023-22680WordPress No API Amazon Affiliate Plugin <= 4.2.2 is vulnerable to Cross Site Scripting (XSS)Altanic No API Amazon Affiliate
- CVE-2023-22679WordPress WP Better Emails Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)Nicolas Lemoine WP Better Emails
- CVE-2023-23721WordPress Admin Log Plugin <= 1.50 is vulnerable to Cross Site Request Forgery (CSRF)David Gwyer Admin Log
- CVE-2023-23718WordPress Page Loading Effects Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)Esstat17 Page Loading Effects
- CVE-2023-22678WordPress Superior FAQ Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)Rafael Dery Superior FAQ
- CVE-2023-22681WordPress Online Exam Software : eExamhall Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF)Aarvanshinfotech Online Exam Software : eExamhall
- CVE-2023-24381WordPress Advanced Social Pixel Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)NsThemes Advanced Social Pixel
- CVE-2023-25064WordPress WP htpasswd Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)Matteo Candura WP htpasswd
- CVE-2023-25794WordPress Nooz Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)Mighty Digital Nooz
- CVE-2023-25795WordPress Feed Changer Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)WP-master.ir Feed Changer & Remover
- CVE-2023-1507SourceCodester E-Commerce System Category Name controller.php cross site scriptingSourceCodester E-Commerce System
- CVE-2023-25782WordPress Service Area Postcode Checker Plugin <= 2.0.8 is vulnerable to Cross Site Scripting (XSS)Second2none Service Area Postcode Checker
- CVE-2023-1506SourceCodester E-Commerce System login.php sql injectionSourceCodester E-Commerce System
- CVE-2023-1505SourceCodester E-Commerce System setDiscount.php sql injectionSourceCodester E-Commerce System
- CVE-2023-1504SourceCodester Alphaware Simple E-Commerce System sql injectionSourceCodester Alphaware Simple E-Commerce System
- CVE-2023-1248 Possible XSS in Ticket ActionsOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2023-1503SourceCodester Alphaware Simple E-Commerce System admin_index.php sql injectionSourceCodester Alphaware Simple E-Commerce System
- CVE-2023-1502SourceCodester Alphaware Simple E-Commerce System edit_customer.php sql injectionSourceCodester Alphaware Simple E-Commerce System
- CVE-2022-4933ATM Consulting dolibarr_module_quicksupplierprice interface.php upatePrice sql injectionATM Consulting dolibarr_module_quicksupplierprice
- CVE-2015-10096Zarthus IRC Twitter Announcer Bot twitter_announcer.rb get_tweets command injectionZarthus IRC Twitter Announcer Bot
- CVE-2023-1515Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-1517Cross-site Scripting (XSS) - DOM in pimcore/pimcorepimcore/pimcore