# CVEs published 2023-04-05

139 CVEs were published on April 5, 2023: 7 critical, 28 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-1782](https://cve.now/CVE-2023-1782.md): Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation (CVSS 10.0, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2023-1522](https://cve.now/CVE-2023-1522.md): SQL Injection in the Hardware Inventory report of Security Center 5.11.2. (CVSS 8.8, Genetec Security Center)
- [CVE-2022-4941](https://cve.now/CVE-2022-4941.md): WCFM Membership \<= 2.9.10 - Cross-Site Request Forgery (CVSS 6.3, wclovers WCFM Membership – WooCommerce Memberships for Mult…)
- [CVE-2022-4940](https://cve.now/CVE-2022-4940.md): WCFM Membership \<= 2.10.0 - Missing Authorization (CVSS 7.3, wclovers WCFM Membership – WooCommerce Memberships for Mult…)
- [CVE-2022-4939](https://cve.now/CVE-2022-4939.md): WCFM Membership \<= 2.10.0 - Unauthenticated Privilege Escalation (CVSS 9.8, wclovers WCFM Membership – WooCommerce Memberships for Mult…)
- [CVE-2023-29006](https://cve.now/CVE-2023-29006.md): Order GLPI plugin vulnerable to remote code execution from authenticated user (CVSS 8.8, pluginsGLPI order)
- [CVE-2023-28855](https://cve.now/CVE-2023-28855.md): Fields GLPI plugin vulnerable to unauthorized write access to additional fields (CVSS 6.5, pluginsGLPI fields)
- [CVE-2023-28852](https://cve.now/CVE-2023-28852.md): GLPI vulnerable to stored Cross-site Scripting through dashboard administration (CVSS 4.8, glpi-project glpi)
- [CVE-2023-28849](https://cve.now/CVE-2023-28849.md): GLPI vulnerable to SQL injection and Stored XSS via inventory agent request (CVSS 10.0, glpi-project glpi)
- [CVE-2022-4938](https://cve.now/CVE-2022-4938.md): WCFM Frontend Manager \<= 6.5.13 - Cross-Site Request Forgery (CVSS 6.3, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2022-4937](https://cve.now/CVE-2022-4937.md): The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and includin (CVSS 6.3, wclovers WCFM – Frontend Manager for WooCommerce along with…)
- [CVE-2023-28838](https://cve.now/CVE-2023-28838.md): GLPI vulnerable to SQL injection through dynamic reports (CVSS 9.6, glpi-project glpi)
- [CVE-2022-4936](https://cve.now/CVE-2022-4936.md): WCFM Marketplace \<= 3.4.12 - Cross-Site Request Forgery (CVSS 6.3, wclovers WCFM Marketplace – Multivendor Marketplace for Woo…)
- [CVE-2022-4935](https://cve.now/CVE-2022-4935.md): WCFM Marketplace \<= 3.4.11 - Missing Authorization (CVSS 8.8, wclovers WCFM Marketplace – Multivendor Marketplace for Woo…)
- [CVE-2023-28636](https://cve.now/CVE-2023-28636.md): GLPI vulnerable to stored Cross-site Scripting in external links (CVSS 4.5, glpi-project glpi)
- [CVE-2023-28634](https://cve.now/CVE-2023-28634.md): GLPI vulnerable to Privilege Escalation from Technician to Super-Admin (CVSS 8.8, glpi-project glpi)
- [CVE-2023-20118](https://cve.now/CVE-2023-20118.md): A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers (CVSS 6.5, KEV, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-28633](https://cve.now/CVE-2023-28633.md): GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds (CVSS 3.5, glpi-project glpi)
- [CVE-2023-1412](https://cve.now/CVE-2023-1412.md): Local Privilege Escalation Vulnerability in WARP's MSI Installer (CVSS 7.0, Cloudflare WARP)
- [CVE-2022-43664](https://cve.now/CVE-2022-43664.md): A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. (CVSS 7.8, Ichitaro)
- [CVE-2022-45115](https://cve.now/CVE-2022-45115.md): A buffer overflow vulnerability exists in the Attribute Arena functionality of Ichitaro 2022 1.0.1.57600. (CVSS 7.8, Ichitaro)
- [CVE-2023-22291](https://cve.now/CVE-2023-22291.md): An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. (CVSS 7.0, Ichitaro)
- [CVE-2023-22660](https://cve.now/CVE-2023-22660.md): A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record typ (CVSS 7.0, Ichitaro)
- [CVE-2023-28632](https://cve.now/CVE-2023-28632.md): GLPI vulnerable to account takeover by authenticated user (CVSS 8.1, glpi-project glpi)
- [CVE-2023-1871](https://cve.now/CVE-2023-1871.md): YourChannel \<= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Reset (CVSS 5.4, pluginbuilders YourChannel: Everything you want in a YouTub…)
- [CVE-2023-1870](https://cve.now/CVE-2023-1870.md): YourChannel \<= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Update (CVSS 4.3, pluginbuilders YourChannel: Everything you want in a YouTub…)
- [CVE-2023-1869](https://cve.now/CVE-2023-1869.md): YourChannel \<= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, pluginbuilders YourChannel: Everything you want in a YouTub…)
- [CVE-2023-1868](https://cve.now/CVE-2023-1868.md): YourChannel \<= 1.2.3 - Missing Authorization to Plugin Cache Reset (CVSS 6.5, pluginbuilders YourChannel: Everything you want in a YouTub…)
- [CVE-2023-1867](https://cve.now/CVE-2023-1867.md): YourChannel \<= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Change (CVSS 5.4, pluginbuilders YourChannel: Everything you want in a YouTub…)
- [CVE-2023-1866](https://cve.now/CVE-2023-1866.md): YourChannel \<= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Reset (CVSS 5.4, pluginbuilders YourChannel: Everything you want in a YouTub…)
- [CVE-2023-1865](https://cve.now/CVE-2023-1865.md): YourChannel \<= 1.2.3 - Missing Authorization to Plugin Settings Reset (CVSS 6.5, pluginbuilders YourChannel: Everything you want in a YouTub…)
- [CVE-2013-10022](https://cve.now/CVE-2013-10022.md): BestWebSoft Contact Form Plugin contact\_form.php cntctfrm\_check\_form cross site scripting (CVSS 3.5, BestWebSoft Contact Form Plugin)
- [CVE-2023-1860](https://cve.now/CVE-2023-1860.md): Keysight IXIA Hawkeye licenses cross site scripting (CVSS 3.5, Keysight IXIA Hawkeye)
- [CVE-2023-1858](https://cve.now/CVE-2023-1858.md): SourceCodester Earnings and Expense Tracker App index.php information disclosure (CVSS 4.3, SourceCodester Earnings and Expense Tracker App)
- [CVE-2023-28069](https://cve.now/CVE-2023-28069.md): Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. (CVSS 6.1, Dell Streaming Data Platform)
- [CVE-2023-1857](https://cve.now/CVE-2023-1857.md): SourceCodester Online Computer and Laptop Store cross site scripting (CVSS 2.4, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-1856](https://cve.now/CVE-2023-1856.md): SourceCodester Air Cargo Management System GET Parameter track\_shipment.php sql injection (CVSS 6.3, SourceCodester Air Cargo Management System)
- [CVE-2023-1854](https://cve.now/CVE-2023-1854.md): SourceCodester Online Graduate Tracer System session expiration (CVSS 4.7, SourceCodester Online Graduate Tracer System)
- [CVE-2023-1853](https://cve.now/CVE-2023-1853.md): SourceCodester Online Payroll System employee\_edit.php cross site scripting (CVSS 3.5, SourceCodester Online Payroll System)
- [CVE-2023-1852](https://cve.now/CVE-2023-1852.md): SourceCodester Online Payroll System deduction\_edit.php cross site scripting (CVSS 3.5, SourceCodester Online Payroll System)
- [CVE-2023-1851](https://cve.now/CVE-2023-1851.md): SourceCodester Online Payroll System employee\_add.php cross site scripting (CVSS 3.5, SourceCodester Online Payroll System)
- [CVE-2023-26536](https://cve.now/CVE-2023-26536.md): WordPress Sp\*tify Play Button for WordPress Plugin \<= 2.05 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Jonk @ Follow me Darling Sp\*tify Play Button for WordPress)
- [CVE-2023-1850](https://cve.now/CVE-2023-1850.md): SourceCodester Online Payroll System login.php sql injection (CVSS 6.3, SourceCodester Online Payroll System)
- [CVE-2023-1849](https://cve.now/CVE-2023-1849.md): SourceCodester Online Payroll System cashadvance\_row.php sql injection (CVSS 6.3, SourceCodester Online Payroll System)
- [CVE-2023-1848](https://cve.now/CVE-2023-1848.md): SourceCodester Online Payroll System attendance\_row.php sql injection (CVSS 6.3, SourceCodester Online Payroll System)
- [CVE-2023-1847](https://cve.now/CVE-2023-1847.md): SourceCodester Online Payroll System attendance.php sql injection (CVSS 6.3, SourceCodester Online Payroll System)
- [CVE-2023-1846](https://cve.now/CVE-2023-1846.md): SourceCodester Online Payroll System deduction\_row.php sql injection (CVSS 6.3, SourceCodester Online Payroll System)
- [CVE-2023-0382](https://cve.now/CVE-2023-0382.md): Uncontrolled Resource Consumption in M-Files Server (CVSS 6.5, M-Files Server)
- [CVE-2023-1845](https://cve.now/CVE-2023-1845.md): SourceCodester Online Payroll System employee\_row.php sql injection (CVSS 6.3, SourceCodester Online Payroll System)
- [CVE-2022-31888](https://cve.now/CVE-2022-31888.md): Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. (CVSS 8.8)
- [CVE-2022-31889](https://cve.now/CVE-2022-31889.md): Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533 (CVSS 6.1)
- [CVE-2022-31890](https://cve.now/CVE-2022-31890.md): SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via (CVSS 9.8)
- [CVE-2022-3375](https://cve.now/CVE-2022-3375.md): An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9 (CVSS 3.1, GitLab)
- [CVE-2022-3513](https://cve.now/CVE-2022-3513.md): An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9. (CVSS 6.1, GitLab)
- [CVE-2023-0319](https://cve.now/CVE-2023-0319.md): An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9. (CVSS 5.8, GitLab)
- [CVE-2023-0450](https://cve.now/CVE-2023-0450.md): An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10. (CVSS 3.7, GitLab)
- [CVE-2023-0523](https://cve.now/CVE-2023-0523.md): An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1 (CVSS 5.4, GitLab)
- [CVE-2023-0670](https://cve.now/CVE-2023-0670.md): Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on (CVSS 7.2, Ulearn)
- [CVE-2023-0838](https://cve.now/CVE-2023-0838.md): An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. (CVSS 5.5, GitLab)
- [CVE-2023-0842](https://cve.now/CVE-2023-0842.md): xml2js 0.4.23 - Prototype Pollution (CVSS 5.3, xml2js)
- [CVE-2023-0944](https://cve.now/CVE-2023-0944.md): Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, (CVSS 4.3, Bhima)
- [CVE-2023-0959](https://cve.now/CVE-2023-0959.md): Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sen (CVSS 6.5, Bhima)
- [CVE-2023-0967](https://cve.now/CVE-2023-0967.md): Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and dat (CVSS 6.5, Bhima)
- [CVE-2023-1071](https://cve.now/CVE-2023-1071.md): An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all ve (CVSS 3.1, GitLab)
- [CVE-2023-1098](https://cve.now/CVE-2023-1098.md): An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all ver (CVSS 5.8, GitLab)
- [CVE-2023-1167](https://cve.now/CVE-2023-1167.md): Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all ver (CVSS 5.3, GitLab)
- [CVE-2023-1417](https://cve.now/CVE-2023-1417.md): An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1 (CVSS 4.3, GitLab)
- [CVE-2023-1582](https://cve.now/CVE-2023-1582.md): A race problem was found in fs/proc/task\_mmu.c in the memory management sub-component in the Linux kernel. (CVSS 4.7, Linux)
- [CVE-2023-1708](https://cve.now/CVE-2023-1708.md): An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 wh (CVSS 5.7, GitLab)
- [CVE-2023-1710](https://cve.now/CVE-2023-1710.md): A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 (CVSS 5.3, GitLab)
- [CVE-2023-1733](https://cve.now/CVE-2023-1733.md): A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9. (CVSS 5.8, GitLab)
- [CVE-2023-1756](https://cve.now/CVE-2023-1756.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7, thorsten/phpmyfaq)
- [CVE-2023-1757](https://cve.now/CVE-2023-1757.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.1, thorsten/phpmyfaq)
- [CVE-2023-1758](https://cve.now/CVE-2023-1758.md): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq (CVSS 8.9, thorsten/phpmyfaq)
- [CVE-2023-1787](https://cve.now/CVE-2023-1787.md): An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1 (CVSS 4.3, GitLab)
- [CVE-2023-1788](https://cve.now/CVE-2023-1788.md): Insufficient Session Expiration in firefly-iii/firefly-iii (CVSS 5.4, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2023-1838](https://cve.now/CVE-2023-1838.md): A use-after-free flaw was found in vhost\_net\_set\_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a (no CVSS, Kernel)
- [CVE-2023-1855](https://cve.now/CVE-2023-1855.md): A use-after-free flaw was found in xgene\_hwmon\_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-h (CVSS 6.3, Kernel)
- [CVE-2023-1877](https://cve.now/CVE-2023-1877.md): Command Injection in microweber/microweber (CVSS 6.1, microweber/microweber)
- [CVE-2023-1878](https://cve.now/CVE-2023-1878.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.3, thorsten/phpmyfaq)
- [CVE-2023-1879](https://cve.now/CVE-2023-1879.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7, thorsten/phpmyfaq)
- [CVE-2023-1880](https://cve.now/CVE-2023-1880.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 8.3, thorsten/phpmyfaq)
- [CVE-2023-1881](https://cve.now/CVE-2023-1881.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 7.4, microweber/microweber)
- [CVE-2023-1882](https://cve.now/CVE-2023-1882.md): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (CVSS 8.1, thorsten/phpmyfaq)
- [CVE-2023-1883](https://cve.now/CVE-2023-1883.md): Improper Access Control in thorsten/phpmyfaq (CVSS 5.4, thorsten/phpmyfaq)
- [CVE-2023-1884](https://cve.now/CVE-2023-1884.md): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (CVSS 4.7, thorsten/phpmyfaq)
- [CVE-2023-1885](https://cve.now/CVE-2023-1885.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.3, thorsten/phpmyfaq)
- [CVE-2023-1886](https://cve.now/CVE-2023-1886.md): Authentication Bypass by Capture-replay in thorsten/phpmyfaq (CVSS 7.3, thorsten/phpmyfaq)
- [CVE-2023-1887](https://cve.now/CVE-2023-1887.md): Business Logic Errors in thorsten/phpmyfaq (CVSS 8.3, thorsten/phpmyfaq)
- [CVE-2023-1892](https://cve.now/CVE-2023-1892.md): Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiq (CVSS 8.3, sidekiq/sidekiq · sidekiq)
- [CVE-2023-20021](https://cve.now/CVE-2023-20021.md): Cisco Identity Services Engine Privilege Escalation Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20022](https://cve.now/CVE-2023-20022.md): Cisco Identity Services Engine Privilege Escalation Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20023](https://cve.now/CVE-2023-20023.md): Cisco Identity Services Engine Privilege Escalation Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20030](https://cve.now/CVE-2023-20030.md): Cisco Identity Services Engine XML External Entity Injection Vulnerability (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20051](https://cve.now/CVE-2023-20051.md): Cisco Packet Data Network Gateway IPsec ICMP Denial of Service Vulnerability (CVSS 5.8, Cisco ASR 5000 Series Software)
- [CVE-2023-20068](https://cve.now/CVE-2023-20068.md): Cisco Prime Infrastructure Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Infrastructure)
- [CVE-2023-20073](https://cve.now/CVE-2023-20073.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability (CVSS 5.3, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20096](https://cve.now/CVE-2023-20096.md): Cisco Unified Contact Center Express Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Unified Contact Center Express)
- [CVE-2023-20102](https://cve.now/CVE-2023-20102.md): Cisco Secure Network Analytics Remote Code Execution Vulnerability (CVSS 8.8, Cisco Secure Network Analytics)
- [CVE-2023-20103](https://cve.now/CVE-2023-20103.md): Cisco Secure Network Analytics Remote Code Execution Vulnerability (CVSS 4.9, Cisco Secure Network Analytics)
- [CVE-2023-20117](https://cve.now/CVE-2023-20117.md): Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities (CVSS 7.2, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20121](https://cve.now/CVE-2023-20121.md): Cisco Evolved Programmable Network Manager, Cisco Identity Services Engine, and Cisco Prime Infrastructure Command Injection Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20122](https://cve.now/CVE-2023-20122.md): Cisco Evolved Programmable Network Manager, Cisco Identity Services Engine, and Cisco Prime Infrastructure Command Injection Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20123](https://cve.now/CVE-2023-20123.md): Cisco Duo Authentication for macOS and Duo Authentication for Windows Logon Offline Credentials Replay Vulnerability (CVSS 6.3, Cisco Duo)
- [CVE-2023-20124](https://cve.now/CVE-2023-20124.md): Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Remote Command Execution Vulnerability (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20127](https://cve.now/CVE-2023-20127.md): Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2023-20128](https://cve.now/CVE-2023-20128.md): Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities (CVSS 7.2, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20129](https://cve.now/CVE-2023-20129.md): Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2023-20130](https://cve.now/CVE-2023-20130.md): Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2023-20131](https://cve.now/CVE-2023-20131.md): Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2023-20132](https://cve.now/CVE-2023-20132.md): Cisco Webex Meetings Web UI Vulnerabilities (CVSS 5.4, Cisco Webex Meetings)
- [CVE-2023-20134](https://cve.now/CVE-2023-20134.md): Cisco Webex Meetings Web UI Vulnerabilities (CVSS 5.4, Cisco Webex Meetings)
- [CVE-2023-20137](https://cve.now/CVE-2023-20137.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20138](https://cve.now/CVE-2023-20138.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20139](https://cve.now/CVE-2023-20139.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20140](https://cve.now/CVE-2023-20140.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20141](https://cve.now/CVE-2023-20141.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20142](https://cve.now/CVE-2023-20142.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20143](https://cve.now/CVE-2023-20143.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20144](https://cve.now/CVE-2023-20144.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20145](https://cve.now/CVE-2023-20145.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20146](https://cve.now/CVE-2023-20146.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20147](https://cve.now/CVE-2023-20147.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20148](https://cve.now/CVE-2023-20148.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20149](https://cve.now/CVE-2023-20149.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20150](https://cve.now/CVE-2023-20150.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20151](https://cve.now/CVE-2023-20151.md): Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20152](https://cve.now/CVE-2023-20152.md): Cisco Identity Services Engine Command Injection Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20153](https://cve.now/CVE-2023-20153.md): Cisco Identity Services Engine Command Injection Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-24720](https://cve.now/CVE-2023-24720.md): An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file. (CVSS 9.8)
- [CVE-2023-24747](https://cve.now/CVE-2023-24747.md): Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. (CVSS 5.4)
- [CVE-2023-25330](https://cve.now/CVE-2023-25330.md): A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valu (no CVSS, com.baomidou:mybatis-plus)
- [CVE-2023-26789](https://cve.now/CVE-2023-26789.md): Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS). (CVSS 6.1)
- [CVE-2023-26856](https://cve.now/CVE-2023-26856.md): Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?ac (CVSS 7.2)
- [CVE-2023-26857](https://cve.now/CVE-2023-26857.md): An arbitrary file upload vulnerability in /admin/ajax.php?action=save\_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to (CVSS 7.2)
- [CVE-2023-28342](https://cve.now/CVE-2023-28342.md): Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. (CVSS 7.5)
- [CVE-2023-28639](https://cve.now/CVE-2023-28639.md): GLPI vulnerable to reflected Cross-site Scripting in search pages (CVSS 6.1, glpi)
- [CVE-2023-29374](https://cve.now/CVE-2023-29374.md): In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec met (CVSS 9.8, langchain)
- [CVE-2023-29389](https://cve.now/CVE-2023-29389.md): Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a (CVSS 6.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.