# CVEs published 2023-04-16

38 CVEs were published on April 16, 2023: 10 critical, 8 high. Days are UTC.

- [CVE-2022-45849](https://cve.now/CVE-2022-45849.md): WordPress Activello Theme \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Silkalns Activello)
- [CVE-2022-44734](https://cve.now/CVE-2022-44734.md): WordPress Car Rental by BestWebSoft Plugin \<= 1.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Car Rental by BestWebSoft)
- [CVE-2022-43458](https://cve.now/CVE-2022-43458.md): WordPress Advanced Floating Content Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.1, Code Tides Advanced Floating Content)
- [CVE-2022-43480](https://cve.now/CVE-2022-43480.md): WordPress Homepage Pop-up Plugin \<= 1.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1, Magneticlab Sàrl Homepage Pop-up)
- [CVE-2023-22687](https://cve.now/CVE-2023-22687.md): WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin \<= 1.9.4.0 is vulnerable to Sensitive Data Exposure (CVSS 3.7, Jose Mortellaro Freesoul Deactivate Plugins – Plugin manage…)
- [CVE-2023-30474](https://cve.now/CVE-2023-30474.md): WordPress Ultimate Noindex Nofollow Tool II Plugin \<= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Kilian Evang Ultimate Noindex Nofollow Tool II)
- [CVE-2023-27610](https://cve.now/CVE-2023-27610.md): WordPress Transbank Webpay REST Plugin \<= 1.6.6 is vulnerable to SQL Injection (CVSS 5.5, TransbankDevelopers Transbank Webpay REST)
- [CVE-2023-2108](https://cve.now/CVE-2023-2108.md): SourceCodester Judging Management System edit\_contestant.php sql injection (CVSS 6.3, SourceCodester Judging Management System)
- [CVE-2022-48314](https://cve.now/CVE-2022-48314.md): The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-30542](https://cve.now/CVE-2023-30542.md): GovernorCompatibilityBravo may trim proposal calldata (CVSS 6.8, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2023-29511](https://cve.now/CVE-2023-29511.md): xwiki-platform-administration-ui vulnerable to privilege escalation (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-administ…)
- [CVE-2022-48313](https://cve.now/CVE-2022-48313.md): The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-30537](https://cve.now/CVE-2023-30537.md): org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…)
- [CVE-2023-29509](https://cve.now/CVE-2023-29509.md): org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…)
- [CVE-2023-29508](https://cve.now/CVE-2023-29508.md): org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting (CVSS 8.9, xwiki-platform · org.xwiki.platform:xwiki-platform-livedata…)
- [CVE-2023-29507](https://cve.now/CVE-2023-29507.md): org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-29506](https://cve.now/CVE-2023-29506.md): org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints (CVSS 5.4, xwiki-platform · org.xwiki.platform:xwiki-platform-security…)
- [CVE-2023-29214](https://cve.now/CVE-2023-29214.md): org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-panels-ui)
- [CVE-2023-29212](https://cve.now/CVE-2023-29212.md): xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-panels-ui)
- [CVE-2023-29211](https://cve.now/CVE-2023-29211.md): org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-wiki-ui-…)
- [CVE-2022-48312](https://cve.now/CVE-2022-48312.md): The HwPCAssistant module has the out-of-bounds read/write vulnerability. (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-33990](https://cve.now/CVE-2021-33990.md): Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. (CVSS 9.8)
- [CVE-2021-36520](https://cve.now/CVE-2021-36520.md): A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI. (CVSS 7.5)
- [CVE-2022-28353](https://cve.now/CVE-2022-28353.md): In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS. (CVSS 6.1)
- [CVE-2022-30076](https://cve.now/CVE-2022-30076.md): ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 thro (CVSS 5.3)
- [CVE-2022-34125](https://cve.now/CVE-2022-34125.md): front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a \_log/ pathn (CVSS 6.5)
- [CVE-2022-34126](https://cve.now/CVE-2022-34126.md): The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. (CVSS 7.5)
- [CVE-2022-34127](https://cve.now/CVE-2022-34127.md): The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. (CVSS 7.5)
- [CVE-2022-34128](https://cve.now/CVE-2022-34128.md): The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. (CVSS 9.8)
- [CVE-2022-37186](https://cve.now/CVE-2022-37186.md): In LemonLDAP::NG before 2.0.15. (CVSS 5.9)
- [CVE-2022-37255](https://cve.now/CVE-2022-37255.md): TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603. (CVSS 7.5)
- [CVE-2022-37306](https://cve.now/CVE-2022-37306.md): OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger. (CVSS 6.1)
- [CVE-2022-37704](https://cve.now/CVE-2022-37704.md): Amanda 3.5.1 allows privilege escalation from the regular user backup to root. (CVSS 6.7)
- [CVE-2022-37705](https://cve.now/CVE-2022-37705.md): A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. (no CVSS)
- [CVE-2022-38840](https://cve.now/CVE-2022-38840.md): cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to l (CVSS 7.5)
- [CVE-2022-38841](https://cve.now/CVE-2022-38841.md): Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute pa (CVSS 8.8)
- [CVE-2022-40946](https://cve.now/CVE-2022-40946.md): On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys\_token paramet (CVSS 7.5)
- [CVE-2023-30772](https://cve.now/CVE-2023-30772.md): The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically pro (CVSS 6.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.