# CVEs published 2023-05-27

24 CVEs were published on May 27, 2023: 1 critical, 7 high. Days are UTC.

- [CVE-2023-32695](https://cve.now/CVE-2023-32695.md): Insufficient validation when decoding a Socket.IO packet (CVSS 7.3, socketio socket.io-parser · socket.io-parser)
- [CVE-2023-2928](https://cve.now/CVE-2023-2928.md): DedeCMS article\_allowurl\_edit.php code injection (CVSS 6.3, DedeCMS)
- [CVE-2023-2927](https://cve.now/CVE-2023-2927.md): JIZHICMS TemplateController.php index server-side request forgery (CVSS 6.3, JIZHICMS)
- [CVE-2023-2926](https://cve.now/CVE-2023-2926.md): SeaCMS Picture Upload member.php denial of service (CVSS 5.4, SeaCMS)
- [CVE-2023-2925](https://cve.now/CVE-2023-2925.md): Webkul krayin crm Edit Person Page 2 cross site scripting (CVSS 2.4, Webkul krayin crm)
- [CVE-2023-2924](https://cve.now/CVE-2023-2924.md): Supcon SimField reportupload.aspx unrestricted upload (CVSS 4.7, Supcon SimField)
- [CVE-2023-2923](https://cve.now/CVE-2023-2923.md): Tenda AC6 fromDhcpListClient stack-based overflow (CVSS 6.3, Tenda AC6)
- [CVE-2023-2922](https://cve.now/CVE-2023-2922.md): SourceCodester Comment System GET Parameter index.php cross site scripting (CVSS 3.5, SourceCodester Comment System)
- [CVE-2023-26127](https://cve.now/CVE-2023-26127.md): All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. (CVSS 7.8, n158)
- [CVE-2023-26128](https://cve.now/CVE-2023-26128.md): All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and san (CVSS 8.4, keep-module-latest)
- [CVE-2023-26129](https://cve.now/CVE-2023-26129.md): All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm (CVSS 8.4, bwm-ng)
- [CVE-2023-33184](https://cve.now/CVE-2023-33184.md): Blind SSRF in the Nextcloud Mail app on avatar endpoint (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-32686](https://cve.now/CVE-2023-32686.md): kiwitcms vulnerable to stored XSS via unrestricted files upload (CVSS 8.1, kiwitcms Kiwi · kiwitcms)
- [CVE-2023-33192](https://cve.now/CVE-2023-33192.md): Improper handling of NTS cookie length that could crash the ntpd-rs server (CVSS 7.5, pendulum-project ntpd-rs · ntpd)
- [CVE-2023-33195](https://cve.now/CVE-2023-33195.md): Craft CMS XSS in RSS widget feed (CVSS 5.0, craftcms cms · craftcms/cms)
- [CVE-2023-33188](https://cve.now/CVE-2023-33188.md): Uncontrolled data used in content resolution (CVSS 6.3, federicoiosue Omni-Notes)
- [CVE-2023-32688](https://cve.now/CVE-2023-32688.md): Invalid push request payload crashes Parse Server (CVSS 4.9, parse-community parse-server-push-adapter · parse-server-pu…)
- [CVE-2015-20108](https://cve.now/CVE-2015-20108.md): xml\_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not use (CVSS 9.8, ruby-saml)
- [CVE-2023-2942](https://cve.now/CVE-2023-2942.md): Improper Input Validation in openemr/openemr (CVSS 8.1, openemr/openemr)
- [CVE-2023-2943](https://cve.now/CVE-2023-2943.md): Code Injection in openemr/openemr (CVSS 4.6, openemr/openemr)
- [CVE-2023-2944](https://cve.now/CVE-2023-2944.md): Improper Access Control in openemr/openemr (CVSS 6.3, openemr/openemr)
- [CVE-2023-2945](https://cve.now/CVE-2023-2945.md): Missing Authorization in openemr/openemr (CVSS 4.3, openemr/openemr)
- [CVE-2023-2946](https://cve.now/CVE-2023-2946.md): Improper Access Control in openemr/openemr (CVSS 6.3, openemr/openemr)
- [CVE-2023-2947](https://cve.now/CVE-2023-2947.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 4.7, openemr/openemr)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.