# CVEs published 2023-04-07

98 CVEs were published on April 7, 2023: 29 critical, 20 high. Days are UTC.

- [CVE-2023-1947](https://cve.now/CVE-2023-1947.md): taoCMS admin.php code injection (CVSS 6.3, taoCMS)
- [CVE-2023-1946](https://cve.now/CVE-2023-1946.md): SourceCodester Survey Application System Add New cross site scripting (CVSS 2.4, SourceCodester Survey Application System)
- [CVE-2023-1801](https://cve.now/CVE-2023-1801.md): The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet. (no CVSS, The Tcpdump Group tcpdump)
- [CVE-2023-23762](https://cve.now/CVE-2023-23762.md): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (CVSS 6.5, GitHub Enterprise Server)
- [CVE-2023-23761](https://cve.now/CVE-2023-23761.md): Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists (CVSS 7.7, GitHub Enterprise Server)
- [CVE-2023-1942](https://cve.now/CVE-2023-1942.md): SourceCodester Online Computer and Laptop Store Avatar unrestricted upload (CVSS 6.3, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-1941](https://cve.now/CVE-2023-1941.md): SourceCodester Simple and Beautiful Shopping Cart System login.php sql injection (CVSS 7.3, SourceCodester Simple and Beautiful Shopping Cart System)
- [CVE-2023-1940](https://cve.now/CVE-2023-1940.md): SourceCodester Simple and Beautiful Shopping Cart System delete\_user\_query.php sql injection (CVSS 6.3, SourceCodester Simple and Beautiful Shopping Cart System)
- [CVE-2023-1909](https://cve.now/CVE-2023-1909.md): PHPGurukul BP Monitoring Management System User Profile Update profile.php sql injection (CVSS 4.7, PHPGurukul BP Monitoring Management System)
- [CVE-2023-28710](https://cve.now/CVE-2023-28710.md): Apache Airflow Spark Provider Arbitrary File Read via JDBC (CVSS 7.5, Apache Software Foundation Apache Airflow Spark Provider ·…)
- [CVE-2023-28706](https://cve.now/CVE-2023-28706.md): Apache Airflow Hive Provider Beeline Remote Command Execution (CVSS 9.8, Apache Software Foundation Apache Airflow Hive Provider · a…)
- [CVE-2023-28707](https://cve.now/CVE-2023-28707.md): Airflow Apache Drill Provider Arbitrary File Read Vulnerability (CVSS 7.5, Apache Software Foundation Apache Airflow Drill Provider… +1)
- [CVE-2023-29388](https://cve.now/CVE-2023-29388.md): WordPress Product Catalog Simple Plugin \<= 1.6.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, impleCode Product Catalog Simple)
- [CVE-2023-29170](https://cve.now/CVE-2023-29170.md): WordPress Product Enquiry for WooCommerce Plugin \<= 2.2.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PI Websolution Product Enquiry for WooCommerce, WooCommerce…)
- [CVE-2023-29171](https://cve.now/CVE-2023-29171.md): WordPress Magic Post Thumbnail Plugin \<= 4.1.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Magic Post Thumbnail)
- [CVE-2023-29172](https://cve.now/CVE-2023-29172.md): WordPress PropertyHive Plugin \<= 1.5.46 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, PropertyHive)
- [CVE-2023-28789](https://cve.now/CVE-2023-28789.md): WordPress Contact Forms by Cimatti Plugin \<= 1.5.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Cimatti Consulting WordPress Contact Forms by Cimatti)
- [CVE-2023-28781](https://cve.now/CVE-2023-28781.md): WordPress Contact Forms by Cimatti Plugin \<= 1.5.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Cimatti Consulting WordPress Contact Forms by Cimatti)
- [CVE-2023-28792](https://cve.now/CVE-2023-28792.md): WordPress Continuous Image Carousel With Lightbox Plugin \<= 1.0.15 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, I Thirteen Web Solution Continuous Image Carousel With Ligh…)
- [CVE-2023-27620](https://cve.now/CVE-2023-27620.md): WordPress Robo Gallery Plugin \<= 3.2.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery)
- [CVE-2023-25442](https://cve.now/CVE-2023-25442.md): WordPress Zeno Font Resizer Plugin \<= 1.7.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Marcel Pol Zeno Font Resizer)
- [CVE-2023-23799](https://cve.now/CVE-2023-23799.md): WordPress Easy Panorama Plugin \<= 1.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Leonardo Giacone Easy Panorama)
- [CVE-2022-43928](https://cve.now/CVE-2022-43928.md): IBM Db2 Mirror for i information disclosure (CVSS 4.9, IBM Db2 Mirror for i)
- [CVE-2022-43914](https://cve.now/CVE-2022-43914.md): IBM TRIRIGA Application Platform cross-site scripting (CVSS 4.6, IBM TRIRIGA Application Platform)
- [CVE-2023-27876](https://cve.now/CVE-2023-27876.md): IBM TRIRIGA Application Platform XML external entity injection (CVSS 7.1, IBM TRIRIGA Application Platform)
- [CVE-2022-33959](https://cve.now/CVE-2022-33959.md): IBM Sterling Order Management privilege escalation (CVSS 5.4, IBM Sterling Order Management)
- [CVE-2023-29094](https://cve.now/CVE-2023-29094.md): WordPress Product page shipping calculator for WooCommerce Plugin \<= 1.3.20 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PI Websolution Product page shipping calculator for WooComm…)
- [CVE-2022-34333](https://cve.now/CVE-2022-34333.md): IBM Sterling Order Management information disclosure (CVSS 5.9, IBM Sterling Order Management)
- [CVE-2023-25713](https://cve.now/CVE-2023-25713.md): WordPress Quick Paypal Payments Plugin \<= 5.7.25 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Fullworks Quick Paypal Payments)
- [CVE-2023-25702](https://cve.now/CVE-2023-25702.md): WordPress Quick Paypal Payments Plugin \<= 5.7.25 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Fullworks Quick Paypal Payments)
- [CVE-2023-25705](https://cve.now/CVE-2023-25705.md): WordPress WP Prayer Plugin \<= 1.9.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Go Prayer WP Prayer)
- [CVE-2023-25712](https://cve.now/CVE-2023-25712.md): WordPress Opt-Out for Google Analytics Plugin \<= 2.3.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WP-Buddy Google Analytics Opt-Out)
- [CVE-2023-25711](https://cve.now/CVE-2023-25711.md): WordPress WPGlobus Translate Options Plugin \<= 2.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, WPGlobus Translate Options)
- [CVE-2023-1726](https://cve.now/CVE-2023-1726.md): XSS in Proliz OBS (CVSS 5.4, Proliz OBS)
- [CVE-2023-25464](https://cve.now/CVE-2023-25464.md): WordPress Twitch Player Plugin \<= 2.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, StreamWeasels Twitch Player)
- [CVE-2023-25716](https://cve.now/CVE-2023-25716.md): WordPress Announce from the Dashboard Plugin \<= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, gqevu6bsiz Announce from the Dashboard)
- [CVE-2023-23994](https://cve.now/CVE-2023-23994.md): WordPress Auto Hide Admin Bar Plugin \<= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Marcel Bootsman Auto Hide Admin Bar)
- [CVE-2023-23885](https://cve.now/CVE-2023-23885.md): WordPress Quick Contact Form Plugin \<= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Fullworks Quick Contact Form)
- [CVE-2023-28993](https://cve.now/CVE-2023-28993.md): WordPress Albo Pretorio Online Plugin \<= 4.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Ignazio Scimone Albo Pretorio On line)
- [CVE-2023-29236](https://cve.now/CVE-2023-29236.md): WordPress Outdoor Theme \<= 3.9.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Cththemes Outdoor)
- [CVE-2023-25041](https://cve.now/CVE-2023-25041.md): WordPress Monolit Theme \<= 2.0.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Cththemes Monolit)
- [CVE-2023-25049](https://cve.now/CVE-2023-25049.md): WordPress eCommerce Product Catalog Plugin \<= 3.3.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, impleCode eCommerce Product Catalog Plugin for WordPress)
- [CVE-2023-25020](https://cve.now/CVE-2023-25020.md): WordPress Arigato Autoresponder and Newsletter Plugin \<= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Kiboko Labs Arigato Autoresponder and Newsletter)
- [CVE-2023-25031](https://cve.now/CVE-2023-25031.md): WordPress Arigato Autoresponder and Newsletter Plugin \<= 2.7.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Kiboko Labs Arigato Autoresponder and Newsletter)
- [CVE-2023-25024](https://cve.now/CVE-2023-25024.md): WordPress Icegram Collect plugin \<= 1.3.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Icegram Collect)
- [CVE-2023-25027](https://cve.now/CVE-2023-25027.md): WordPress Chained Quiz Plugin \<= 1.3.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Kiboko Labs Chained Quiz)
- [CVE-2023-25022](https://cve.now/CVE-2023-25022.md): WordPress Watu Quiz Plugin \<= 3.3.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Kiboko Labs Watu Quiz)
- [CVE-2023-25023](https://cve.now/CVE-2023-25023.md): WordPress WebinarIgnition Plugin \<= 2.14.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Saleswonder.biz Webinar ignition)
- [CVE-2023-25046](https://cve.now/CVE-2023-25046.md): WordPress Podlove Podcast Publisher Plugin \<= 3.8.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Podlove Podcast Publisher)
- [CVE-2023-24398](https://cve.now/CVE-2023-24398.md): WordPress EZP Coming Soon Page Plugin \<= 1.0.7.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Snap Creek Software EZP Coming Soon Page)
- [CVE-2023-24402](https://cve.now/CVE-2023-24402.md): WordPress WP Booking System Plugin \<= 2.0.18 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Veribo, Roland Murg WP Booking System – Booking Calendar)
- [CVE-2023-25059](https://cve.now/CVE-2023-25059.md): WordPress avalex Plugin \<= 3.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, avalex – Automatically secure legal texts)
- [CVE-2023-25061](https://cve.now/CVE-2023-25061.md): WordPress Arigato Autoresponder and Newsletter Plugin \<= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Kiboko Labs Arigato Autoresponder and Newsletter)
- [CVE-2023-1937](https://cve.now/CVE-2023-1937.md): zhenfeng13 My-Blog userInfo cross-site request forgery (CVSS 4.3, zhenfeng13 My-Blog)
- [CVE-2023-28051](https://cve.now/CVE-2023-28051.md): Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. (CVSS 7.8, Dell Power Manager)
- [CVE-2020-11935](https://cve.now/CVE-2020-11935.md): aufs: improperly managed inode reference counts in the vfsub\_dentry\_open() method (CVSS 4.4, Ubuntu Linux kernel)
- [CVE-2022-43309](https://cve.now/CVE-2022-43309.md): Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. (CVSS 5.5)
- [CVE-2023-24797](https://cve.now/CVE-2023-24797.md): D-Link DIR882 DIR882A1\_FW110B02 was discovered to contain a stack overflow in the sub\_48AC20 function. (CVSS 9.8)
- [CVE-2023-24798](https://cve.now/CVE-2023-24798.md): D-Link DIR878 DIR\_878\_FW120B05 was discovered to contain a stack overflow in the sub\_475FB0 function. (CVSS 9.8)
- [CVE-2023-24799](https://cve.now/CVE-2023-24799.md): D-Link DIR878 DIR\_878\_FW120B05 was discovered to contain a stack overflow in the sub\_48AF78 function. (CVSS 9.8)
- [CVE-2023-24800](https://cve.now/CVE-2023-24800.md): D-Link DIR878 DIR\_878\_FW120B05 was discovered to contain a stack overflow in the sub\_495220 function. (CVSS 9.8)
- [CVE-2023-25210](https://cve.now/CVE-2023-25210.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the fromSetSysTime function. (CVSS 9.8)
- [CVE-2023-25211](https://cve.now/CVE-2023-25211.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the R7WebsSecurityHandler function. (CVSS 9.8)
- [CVE-2023-25212](https://cve.now/CVE-2023-25212.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the fromSetWirelessRepeat function. (CVSS 9.8)
- [CVE-2023-25213](https://cve.now/CVE-2023-25213.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the check\_param\_changed function. (CVSS 9.8)
- [CVE-2023-25214](https://cve.now/CVE-2023-25214.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the setSchedWifi function. (CVSS 9.8)
- [CVE-2023-25215](https://cve.now/CVE-2023-25215.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the saveParentControlInfo function. (CVSS 9.8)
- [CVE-2023-25216](https://cve.now/CVE-2023-25216.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the formSetFirewallCfg function. (CVSS 9.8)
- [CVE-2023-25217](https://cve.now/CVE-2023-25217.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the formWifiBasicSet function. (CVSS 9.8)
- [CVE-2023-25218](https://cve.now/CVE-2023-25218.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the form\_fast\_setting\_wifi\_set function. (CVSS 9.8)
- [CVE-2023-25219](https://cve.now/CVE-2023-25219.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the fromDhcpListClient function. (CVSS 9.8)
- [CVE-2023-25220](https://cve.now/CVE-2023-25220.md): Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 was discovered to contain a stack overflow via the add\_white\_node function. (CVSS 9.8)
- [CVE-2023-26817](https://cve.now/CVE-2023-26817.md): codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controller (CVSS 8.8)
- [CVE-2023-26820](https://cve.now/CVE-2023-26820.md): siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js. (CVSS 7.5)
- [CVE-2023-26848](https://cve.now/CVE-2023-26848.md): TOTOlink A7100RU(V7.4cu.2313\_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStat (CVSS 9.8)
- [CVE-2023-26978](https://cve.now/CVE-2023-26978.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting (CVSS 9.8)
- [CVE-2023-27012](https://cve.now/CVE-2023-27012.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the setSchedWifi function. (CVSS 9.8)
- [CVE-2023-27013](https://cve.now/CVE-2023-27013.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the get\_parentControl\_list\_Info function. (CVSS 9.8)
- [CVE-2023-27014](https://cve.now/CVE-2023-27014.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the sub\_46AC38 function. (CVSS 9.8)
- [CVE-2023-27015](https://cve.now/CVE-2023-27015.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the sub\_4A75C0 function. (CVSS 9.8)
- [CVE-2023-27016](https://cve.now/CVE-2023-27016.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the R7WebsSecurityHandler function. (CVSS 9.8)
- [CVE-2023-27017](https://cve.now/CVE-2023-27017.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the sub\_45DC58 function. (no CVSS)
- [CVE-2023-27018](https://cve.now/CVE-2023-27018.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the sub\_45EC1C function. (CVSS 9.8)
- [CVE-2023-27019](https://cve.now/CVE-2023-27019.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the sub\_458FBC function. (CVSS 9.8)
- [CVE-2023-27020](https://cve.now/CVE-2023-27020.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the saveParentControlInfo function. (CVSS 9.8)
- [CVE-2023-27021](https://cve.now/CVE-2023-27021.md): Tenda AC10 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via the formSetFirewallCfg function. (CVSS 9.8)
- [CVE-2023-27033](https://cve.now/CVE-2023-27033.md): Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFr (CVSS 9.8)
- [CVE-2023-27180](https://cve.now/CVE-2023-27180.md): GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /\_admin/ba (CVSS 7.5)
- [CVE-2023-27801](https://cve.now/CVE-2023-27801.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27802](https://cve.now/CVE-2023-27802.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditvsList parameter at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27803](https://cve.now/CVE-2023-27803.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27804](https://cve.now/CVE-2023-27804.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27805](https://cve.now/CVE-2023-27805.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27806](https://cve.now/CVE-2023-27806.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos\_lanip\_dellist interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27807](https://cve.now/CVE-2023-27807.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27808](https://cve.now/CVE-2023-27808.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-27810](https://cve.now/CVE-2023-27810.md): H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos\_lanip\_editlist interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29478](https://cve.now/CVE-2023-29478.md): BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on th (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.