# CVEs published 2023-04-09

15 CVEs were published on April 9, 2023: 3 critical, 6 high. Days are UTC.

- [CVE-2012-10012](https://cve.now/CVE-2012-10012.md): BestWebSoft Facebook Like Button facebook-button-plugin.php fcbk\_bttn\_plgn\_settings\_page cross-site request forgery (CVSS 4.3, BestWebSoft Facebook Like Button)
- [CVE-2009-10004](https://cve.now/CVE-2009-10004.md): Turante Sandbox Theme functions.php sandbox\_body\_class cross site scripting (CVSS 3.5, Turante Sandbox Theme)
- [CVE-2012-10011](https://cve.now/CVE-2012-10011.md): HD FLV PLayer Plugin functions.php hd\_update\_media sql injection (CVSS 6.3, HD FLV PLayer Plugin)
- [CVE-2023-1964](https://cve.now/CVE-2023-1964.md): PHPGurukul Bank Locker Management System Password Reset recovery.php sql injection (CVSS 7.3, PHPGurukul Bank Locker Management System)
- [CVE-2023-1963](https://cve.now/CVE-2023-1963.md): PHPGurukul Bank Locker Management System Search index.php sql injection (CVSS 6.3, PHPGurukul Bank Locker Management System)
- [CVE-2023-1962](https://cve.now/CVE-2023-1962.md): SourceCodester Best Online News Portal POST Parameter forgot-password.php sql injection (CVSS 7.3, SourceCodester Best Online News Portal)
- [CVE-2014-125095](https://cve.now/CVE-2014-125095.md): BestWebSoft Contact Form Plugin bws\_menu.php bws\_add\_menu\_render cross site scripting (CVSS 3.5, BestWebSoft Contact Form Plugin)
- [CVE-2012-10010](https://cve.now/CVE-2012-10010.md): BestWebSoft Contact Form contact\_form.php cntctfrm\_settings\_page cross-site request forgery (CVSS 4.3, BestWebSoft Contact Form)
- [CVE-2023-27718](https://cve.now/CVE-2023-27718.md): D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub\_498308 function. (CVSS 9.8)
- [CVE-2023-27719](https://cve.now/CVE-2023-27719.md): D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub\_478360 function. (CVSS 9.8)
- [CVE-2023-27720](https://cve.now/CVE-2023-27720.md): D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub\_48d630 function. (CVSS 9.8)
- [CVE-2023-27727](https://cve.now/CVE-2023-27727.md): Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs\_function\_frame at src/njs\_function.h. (CVSS 7.5)
- [CVE-2023-27728](https://cve.now/CVE-2023-27728.md): Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs\_dump\_is\_recursive at src/njs\_vmcode.c. (CVSS 7.5)
- [CVE-2023-27729](https://cve.now/CVE-2023-27729.md): Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs\_vmcode\_return at src/njs\_vmcode.c. (CVSS 7.5)
- [CVE-2023-27730](https://cve.now/CVE-2023-27730.md): Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs\_lvlhsh\_find at src/njs\_lvlhsh.c. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.