# CVEs published 2023-06-07

185 CVEs were published on June 7, 2023: 36 critical, 62 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-34238](https://cve.now/CVE-2023-34238.md): Local File Inclusion vulnerability in Gatsby (CVSS 4.3, gatsbyjs gatsby · gatsby)
- [CVE-2023-34239](https://cve.now/CVE-2023-34239.md): Unfiltered paths in gradio (CVSS 7.3, gradio-app gradio · gradio)
- [CVE-2023-2904](https://cve.now/CVE-2023-2904.md): CVE-2023-2904 (CVSS 7.3, HID Global SAFE)
- [CVE-2023-31200](https://cve.now/CVE-2023-31200.md): PTC Vuforia Studio Cross-Site Request Forgery (CVSS 5.7, PTC Vuforia Studio)
- [CVE-2023-29502](https://cve.now/CVE-2023-29502.md): PTC Vuforia Studio Path Traversal (CVSS 6.2, PTC Vuforia Studio)
- [CVE-2023-27881](https://cve.now/CVE-2023-27881.md): PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type (CVSS 8.0, PTC Vuforia Studio)
- [CVE-2023-29152](https://cve.now/CVE-2023-29152.md): PTC Vuforia Studio Improper Authorization (CVSS 6.2, PTC Vuforia Studio)
- [CVE-2023-24476](https://cve.now/CVE-2023-24476.md): PTC Vuforia Studio Improper Authorization (CVSS 1.8, PTC Vuforia Studio)
- [CVE-2023-29168](https://cve.now/CVE-2023-29168.md): PTC Vuforia Studio Insufficiently Protected Credentials (CVSS 3.7, PTC Vuforia Studio)
- [CVE-2023-33849](https://cve.now/CVE-2023-33849.md): IBM CICS TX information disclosure (CVSS 3.7, IBM TXSeries for Multiplatforms · IBM CICS TX Standard +1)
- [CVE-2023-25177](https://cve.now/CVE-2023-25177.md): Delta Electronics CNCSoft-B DOPSoft Stack-based buffer overflow (CVSS 7.8, Delta Electronics CNCSoft-B DOPSoft)
- [CVE-2023-24014](https://cve.now/CVE-2023-24014.md): Delta Electronics CNCSoft-B DOPSoft Heap-based buffer overflow (CVSS 7.8, Delta Electronics CNCSoft-B DOPSoft)
- [CVE-2023-1864](https://cve.now/CVE-2023-1864.md): FANUC ROBOGUIDE-HandlingPRO Path Traversal (CVSS 6.8, FANUC ROBOGUIDE-HandlingPRO)
- [CVE-2023-1709](https://cve.now/CVE-2023-1709.md): Datalogics Library APDFL Stack-based Buffer Overflow (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-33848](https://cve.now/CVE-2023-33848.md): IBM CICS TX information disclosure (CVSS 4.9, IBM TXSeries for Multiplatforms · IBM CICS TX Standard +1)
- [CVE-2023-2866](https://cve.now/CVE-2023-2866.md): Advantech WebAccess Insufficient Type Distinction (CVSS 7.3, Advantech WebAccess/SCADA)
- [CVE-2023-34237](https://cve.now/CVE-2023-34237.md): Remote code execution via specially crafted script settings in SABnzbd (CVSS 8.1, sabnzbd)
- [CVE-2023-3152](https://cve.now/CVE-2023-3152.md): SourceCodester Online Discussion Forum Site view\_post.php sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-29345](https://cve.now/CVE-2023-29345.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2023-3151](https://cve.now/CVE-2023-3151.md): SourceCodester Online Discussion Forum Site manage\_user.php sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-3150](https://cve.now/CVE-2023-3150.md): SourceCodester Online Discussion Forum Site manage\_post.php sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-34108](https://cve.now/CVE-2023-34108.md): Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords (CVSS 8.8, mailcow-dockerized)
- [CVE-2023-34109](https://cve.now/CVE-2023-34109.md): User input results in Unbounded resource consumption in @zxcvbn-ts/core (CVSS 6.5, zxcvbn-ts zxcvbn)
- [CVE-2023-34234](https://cve.now/CVE-2023-34234.md): Governor proposal creation may be blocked by frontrunning in OpenZeppelin (CVSS 5.3, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2023-3149](https://cve.now/CVE-2023-3149.md): SourceCodester Online Discussion Forum Site manage\_user.php sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-3148](https://cve.now/CVE-2023-3148.md): SourceCodester Online Discussion Forum Site manage\_post.php sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-3147](https://cve.now/CVE-2023-3147.md): SourceCodester Online Discussion Forum Site view\_category.php sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-3146](https://cve.now/CVE-2023-3146.md): SourceCodester Online Discussion Forum Site manage\_category.php sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-3145](https://cve.now/CVE-2023-3145.md): SourceCodester Online Discussion Forum Site sql injection (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2023-3144](https://cve.now/CVE-2023-3144.md): SourceCodester Online Discussion Forum Site manage\_post.php cross site scripting (CVSS 3.5, SourceCodester Online Discussion Forum Site)
- [CVE-2023-2878](https://cve.now/CVE-2023-2878.md): Kubernetes secrets-store-csi-driver discloses service account tokens in logs (CVSS 6.5, Kubernetes secrets-store-csi-driver · sigs.k8s.io/secrets-s…)
- [CVE-2023-3143](https://cve.now/CVE-2023-3143.md): SourceCodester Online Discussion Forum Site manage\_post.php cross site scripting (CVSS 3.5, SourceCodester Online Discussion Forum Site)
- [CVE-2023-20889](https://cve.now/CVE-2023-20889.md): Aria Operations for Networks contains an information disclosure vulnerability. (CVSS 7.5, Aria Operations for Networks)
- [CVE-2023-20888](https://cve.now/CVE-2023-20888.md): Aria Operations for Networks contains an authenticated deserialization vulnerability. (CVSS 8.8, Aria Operations for Networks)
- [CVE-2023-20887](https://cve.now/CVE-2023-20887.md): Aria Operations for Networks contains a command injection vulnerability. (CVSS 9.8, KEV, Aria Operations for Networks)
- [CVE-2020-36728](https://cve.now/CVE-2020-36728.md): Adning Advertising \<= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal (CVSS 6.5, tunafish Adning Advertising)
- [CVE-2021-4380](https://cve.now/CVE-2021-4380.md): Pinterest Automatic \<= 4.14.3 - Unuathenticated Arbitrary Options Update (CVSS 9.8, ValvePress Pinterest Automatic)
- [CVE-2021-4379](https://cve.now/CVE-2021-4379.md): WooCommerce Multi Currency \<= 2.1.17 - Missing Authorization (CVSS 6.5, villatheme CURCY - WooCommerce Multi Currency - Currency Sw…)
- [CVE-2020-36705](https://cve.now/CVE-2020-36705.md): Adning Advertising \<= 1.5.5 - Arbitrary File Upload (CVSS 9.8, tunafish Adning Advertising)
- [CVE-2021-4337](https://cve.now/CVE-2021-4337.md): Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization (CVSS 8.8, XforWooCommerce Package Quantity Discount · XforWooComme… +6)
- [CVE-2023-3140](https://cve.now/CVE-2023-3140.md): KNIME Hub Web Application is vulnerable to clickjacking (CVSS 4.3, KNIME Business Hub)
- [CVE-2023-2541](https://cve.now/CVE-2023-2541.md): Sensitive information disclosure in KNIME Hub Web Application (CVSS 5.3, KNIME Business Hub)
- [CVE-2023-30576](https://cve.now/CVE-2023-30576.md): Apache Guacamole: Use-after-free in handling of RDP audio input buffer (CVSS 6.8, Apache Software Foundation Apache Guacamole)
- [CVE-2023-30575](https://cve.now/CVE-2023-30575.md): Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths (CVSS 6.5, Apache Software Foundation Apache Guacamole)
- [CVE-2023-0976](https://cve.now/CVE-2023-0976.md): A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/T (CVSS 6.3, Trellix Agent)
- [CVE-2023-1388](https://cve.now/CVE-2023-1388.md): A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory (CVSS 6.3, Trellix Agent)
- [CVE-2023-2187](https://cve.now/CVE-2023-2187.md): On Triangle MicroWorks' SCADA Data Gateway version \<= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the We (CVSS 5.3, Triangle MicroWorks SCADA Data Gateway)
- [CVE-2023-2186](https://cve.now/CVE-2023-2186.md): On Triangle MicroWorks' SCADA Data Gateway version \<= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message i (CVSS 8.2, Triangle MicroWorks SCADA Data Gateway)
- [CVE-2023-0667](https://cve.now/CVE-2023-0667.md): Wireshark MSMMS parsing buffer overflow (CVSS 6.5, Wireshark Foundation Wireshark)
- [CVE-2023-0668](https://cve.now/CVE-2023-0668.md): Wireshark IEEE-C37.118 parsing buffer overflow (CVSS 6.5, Wireshark Foundation Wireshark)
- [CVE-2023-0666](https://cve.now/CVE-2023-0666.md): Wireshark RTPS Parsing Buffer Overflow (CVSS 6.5, Wireshark Foundation Wireshark)
- [CVE-2021-4381](https://cve.now/CVE-2021-4381.md): uListing \<= 1.6.6 - Unauthenticated Options Changes via wp\_route (CVSS 9.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2020-36731](https://cve.now/CVE-2020-36731.md): Flexible Checkout Fields for WooCommerce \<= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update (CVSS 7.2, wpdesk Flexible Checkout Fields for WooCommerce – WooCommer…)
- [CVE-2021-4382](https://cve.now/CVE-2021-4382.md): Recently \<= 3.0.4 - Arbitrary File Upload to Remote Code Exectution (CVSS 8.8, hcabrera Recently)
- [CVE-2022-4950](https://cve.now/CVE-2022-4950.md): Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation (CVSS 8.8, narinder-singh The Events Calendar Events Notification B… +8)
- [CVE-2019-25150](https://cve.now/CVE-2019-25150.md): Email Templates \<= 1.3 - HTML Injection (CVSS 8.8, saadiqbal Email Templates Customizer and Designer for WordP…)
- [CVE-2021-4383](https://cve.now/CVE-2021-4383.md): WP Quick FrontEnd Editor \<= 5.5 - Authenticated (Subscriber+) Content Injection (CVSS 8.1, labibahmed42 WP Quick FrontEnd Editor – WordPress Plugin)
- [CVE-2020-36730](https://cve.now/CVE-2020-36730.md): CMP \<= 3.8.1 - Missing Authorization (CVSS 8.3, CMP – Coming Soon & Maintenance Plugin by NiteoThemes)
- [CVE-2019-25151](https://cve.now/CVE-2019-25151.md): Funnel Builder \<= 1.3.0 - Arbitrary Plugin Activation (CVSS 5.4, brainstormforce CartFlows – Funnel Builder & Checkout Plugi…)
- [CVE-2020-36729](https://cve.now/CVE-2020-36729.md): Slideshow, Image Slider by 2J \<= 1.3.31 - Authorization Bypass (CVSS 5.4, 2j-slideshow Slideshow, Image Slider by)
- [CVE-2022-4949](https://cve.now/CVE-2022-4949.md): AdSanity \< 1.8.2 - Authenticated Arbitrary File Upload (CVSS 8.8, https://adsanityplugin.com/ AdSanity)
- [CVE-2021-4377](https://cve.now/CVE-2021-4377.md): Doneren met Mollie \<= 2.8.4 - Information Disclosure (CVSS 6.5, ndijkstra Doneren met Mollie)
- [CVE-2021-4378](https://cve.now/CVE-2021-4378.md): WP Quick FrontEnd Editor \<= 5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, labibahmed42 WP Quick FrontEnd Editor – WordPress Plugin)
- [CVE-2019-25149](https://cve.now/CVE-2019-25149.md): Gallery Images Ape \<= 2.0.6 - Authenticated Plugin Deactivation (CVSS 7.6, galleryape Gallery Images Ape)
- [CVE-2020-36727](https://cve.now/CVE-2020-36727.md): Newsletter Manager \<= 1.5.1 - Insecure Deserialization (CVSS 9.8, f1logic Newsletter Manager)
- [CVE-2020-36726](https://cve.now/CVE-2020-36726.md): Ultimate Reviews \< 2.1.33 - PHP Object Injection (CVSS 9.8, rustaurius Ultimate Reviews)
- [CVE-2021-4376](https://cve.now/CVE-2021-4376.md): WooCommerce Multi Currency \<= 2.1.17 - Missing Authorization (CVSS 4.3, villatheme CURCY – Multi Currency for WooCommerce – Smoothl…)
- [CVE-2021-4375](https://cve.now/CVE-2021-4375.md): Welcart e-Commerce \< 2.2.8 - Missing Capabilities Check to Information Disclosure (CVSS 4.3, uscnanbu Welcart e-Commerce)
- [CVE-2020-36725](https://cve.now/CVE-2020-36725.md): TI WooCommerce Wishlist \<= 1.21.11 and TI WooCommerce Wishlist Pro \<= 1.21.4 - Arbitrary Options Update (CVSS 8.8, TemplateInvaders TI WooCommerce Wishlist Pro · templateinva…)
- [CVE-2023-3126](https://cve.now/CVE-2023-3126.md): B2BKing \<= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure (CVSS 4.3, webwizardsdev B2BKing — Ultimate WooCommerce B2B and Wholes…)
- [CVE-2021-4374](https://cve.now/CVE-2021-4374.md): WordPress Automatic Plugin \<= 3.53.2 - Unauthenticated Arbitrary Options Update (CVSS 9.1, ValvePress WordPress Automatic Plugin)
- [CVE-2021-4373](https://cve.now/CVE-2021-4373.md): Better Search \<= 2.5.2 - Cross-Site Request Forgery to Settings Import (CVSS 8.8, ajay Better Search – Relevant search results for WordPress)
- [CVE-2021-4370](https://cve.now/CVE-2021-4370.md): uListing \<= 1.6.6 - Missing Authorization (CVSS 9.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2020-36722](https://cve.now/CVE-2020-36722.md): Visual Composer \<= 26.0 - Multiple Cross-Site Scripting (CVSS 5.5, visualcomposer Visual Composer Website Builder)
- [CVE-2021-4369](https://cve.now/CVE-2021-4369.md): Frontend File Manager \<= 18.2 - Unauthenticated Content Injection (CVSS 5.8, nmedia Frontend File Manager Plugin)
- [CVE-2021-4371](https://cve.now/CVE-2021-4371.md): WP Quick FrontEnd Editor \<= 5.5 - Authenticated Settings Change (CVSS 4.3, labibahmed42 WP Quick FrontEnd Editor – WordPress Plugin)
- [CVE-2020-36724](https://cve.now/CVE-2020-36724.md): Wordable \<= 3.1.1 - Authentication Bypass (CVSS 9.8, Wordable – Export Google Docs to WordPress)
- [CVE-2021-4372](https://cve.now/CVE-2021-4372.md): WooCommerce Dynamic Pricing and Discounts \<= 2.4.1 - Stored Cross-Site Scripting (CVSS 6.5, RightPress WooCommerce Dynamic Pricing and Discounts)
- [CVE-2020-36723](https://cve.now/CVE-2020-36723.md): ListingPro - WordPress Directory & Listing Theme \< 2.6.1 - Sensitive Information Disclosure (CVSS 5.3, ListingPro - WordPress Directory & Listing Theme)
- [CVE-2023-3125](https://cve.now/CVE-2023-3125.md): B2BKing \<= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification (CVSS 6.5, webwizardsdev B2BKing — Ultimate WooCommerce B2B and Wholes…)
- [CVE-2019-25148](https://cve.now/CVE-2019-25148.md): WP HTML Mail \< 2.9.1 - HTML Injection (CVSS 6.1, haet Email Template Designer – WP HTML Mail)
- [CVE-2016-15033](https://cve.now/CVE-2016-15033.md): Delete All Comments \<= 2.0 - Arbitrary File Upload (CVSS 9.8, Ganesh Chandra Delete All Comments)
- [CVE-2019-25147](https://cve.now/CVE-2019-25147.md): Pretty Links \<= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track\_link (CVSS 7.2, supercleanse PrettyLinks – Affiliate Links, Link Branding,…)
- [CVE-2021-4368](https://cve.now/CVE-2021-4368.md): Frontend File Manager \<= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload (CVSS 9.9, nmedia Frontend File Manager Plugin)
- [CVE-2019-25146](https://cve.now/CVE-2019-25146.md): DELUCKS SEO \< 2.1.8 - Stored Cross Site Scripting (CVSS 7.2, DELUCKS SEO)
- [CVE-2020-36721](https://cve.now/CVE-2020-36721.md): Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation (CVSS 6.5, wpchill Brilliance · silkalns Newspaper X +1)
- [CVE-2021-4365](https://cve.now/CVE-2021-4365.md): Frontend File Manager \<= 18.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, nmedia Frontend File Manager Plugin)
- [CVE-2021-4366](https://cve.now/CVE-2021-4366.md): PWA for WP & AMP \< = 1.7.32 - Missing Authorization (CVSS 6.3, magazine3 PWA for WP – Progressive Web Apps Made Simple)
- [CVE-2020-36717](https://cve.now/CVE-2020-36717.md): Kali Forms \<= 2.1.1 - Cross-Site Request Forgery (CVSS 8.8, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2020-36718](https://cve.now/CVE-2020-36718.md): GDPR CCPA Compliance Support \<= 2.3 - PHP Object Injection (CVSS 9.8, ninjateam GDPR CCPA Compliance & Cookie Consent Banner)
- [CVE-2021-4367](https://cve.now/CVE-2021-4367.md): Flo Forms – Easy Drag & Drop Form Builder \<= 1.0.35 - Options Change to Stored Cross-Site Scripting (CVSS 6.4, flothemesplugins Flo Forms – Easy Drag & Drop Form Builder)
- [CVE-2020-36719](https://cve.now/CVE-2020-36719.md): ListingPro - WordPress Directory & Listing Theme \< 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation (CVSS 9.8, ListingPro - WordPress Directory & Listing Theme)
- [CVE-2020-36720](https://cve.now/CVE-2020-36720.md): Kali Forms \<= 2.1.1 - Missing Authorization to Settings Update (CVSS 7.1, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2019-25145](https://cve.now/CVE-2019-25145.md): Contact Form & SMTP Plugin by PirateForms \<= 2.5.1 - Unauthenticated HTML injection (CVSS 7.2, smub Contact Form & SMTP Plugin for WordPress by PirateForms)
- [CVE-2020-36716](https://cve.now/CVE-2020-36716.md): WP Activity Log \<= 4.0.1 - Missing Authorization (CVSS 7.3, melapress WP Activity Log)
- [CVE-2020-36715](https://cve.now/CVE-2020-36715.md): Login/Signup Popup \< 1.5 - Missing Authorization (CVSS 7.4, xootix Login & Register Customizer – Popup | Slider | Inlin…)
- [CVE-2019-25144](https://cve.now/CVE-2019-25144.md): WP HTML Mail \< 2.2.11 - HTML injection (CVSS 5.4, a3rev WP Email Template)
- [CVE-2020-36713](https://cve.now/CVE-2020-36713.md): MStore API \<= 2.1.5 - Authentication Bypass (CVSS 9.8, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2020-36712](https://cve.now/CVE-2020-36712.md): Kali Forms \<= 2.1.1 - Unauthenticated Arbitrary Post Deletion (CVSS 8.6, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2019-25143](https://cve.now/CVE-2019-25143.md): GDPR Cookie Compliance \<= 4.0.2 - Missing Authorization (CVSS 5.4, mooveagency GDPR Cookie Compliance – Cookie Banner, Cookie…)
- [CVE-2021-4364](https://cve.now/CVE-2021-4364.md): JobSearch WP Job Board \< = 1.8.1 - Missing Authorization on jobsearch\_update\_job\_import\_schedule\_call() function (CVSS 4.3, eyecix JobSearch WP Job Board)
- [CVE-2019-25142](https://cve.now/CVE-2019-25142.md): Mesmerize \<= 1.6.89 & Materialis \<= 1.0.172 - Authenticated Arbitrary Options Update (CVSS 8.8, extendthemes Materialis · extendthemes Mesmerize)
- [CVE-2021-4360](https://cve.now/CVE-2021-4360.md): Controlled Admin Access \< 1.5.6 - Privilege Escalation (CVSS 9.9, waseem\_senjer Controlled Admin Access)
- [CVE-2021-4359](https://cve.now/CVE-2021-4359.md): Frontend File Manager Plugin \<= 18.2 - Unauthenticated Arbitrary Post Deletion (CVSS 6.5, nmedia Frontend File Manager Plugin)
- [CVE-2019-25141](https://cve.now/CVE-2019-25141.md): Easy WP SMTP \<= 1.3.9 - Missing Authorization to Arbitrary Options Update (CVSS 9.8, smub Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, O…)
- [CVE-2021-4361](https://cve.now/CVE-2021-4361.md): JobSearch WP Job Board \<= 1.8.1 - Missing Authorization to Arbitrary Options Update (CVSS 8.8, eyecix JobSearch WP Job Board)
- [CVE-2021-4362](https://cve.now/CVE-2021-4362.md): The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi\_social\_share\_ (CVSS 9.8, wpkube Social Sharing Plugin – Kiwi)
- [CVE-2021-4363](https://cve.now/CVE-2021-4363.md): WP Quick FrontEnd Editor \<= 5.5 - Reflected Cross-Site Scripting (CVSS 6.1, labibahmed42 WP Quick FrontEnd Editor – WordPress Plugin)
- [CVE-2021-4356](https://cve.now/CVE-2021-4356.md): Frontend File Manager \<= 18.2 - Unauthenticated Arbitrary File Download (CVSS 9.0, nmedia Frontend File Manager Plugin)
- [CVE-2020-36710](https://cve.now/CVE-2020-36710.md): WPS Hide Login \<= 1.5.4.2 - Hidden Login Page Location Disclosure (CVSS 5.3, tabrisrp WPS Hide Login)
- [CVE-2019-25140](https://cve.now/CVE-2019-25140.md): Coming Soon Page & Maintenance Mode \<= 1.8.1 - Stored Cross Site Scripting (CVSS 7.2, wpshopmart Coming Soon Page & Maintenance Mode)
- [CVE-2021-4357](https://cve.now/CVE-2021-4357.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion (CVSS 9.1, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2022-4948](https://cve.now/CVE-2022-4948.md): FlyingPress \<= 3.9.6 - Missing Authorization (CVSS 4.3, FlyingWeb FlyingPress)
- [CVE-2021-4358](https://cve.now/CVE-2021-4358.md): WP DSGVO Tools (GDPR) \<= 3.1.23 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, legalweb WP DSGVO Tools)
- [CVE-2020-36711](https://cve.now/CVE-2020-36711.md): Avada \<= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2021-4355](https://cve.now/CVE-2021-4355.md): Welcart e-Commerce \< 2.2.8 - Missing Capabilities Check to Information Disclosure (CVSS 7.5, uscnanbu Welcart e-Commerce)
- [CVE-2020-36709](https://cve.now/CVE-2020-36709.md): Page Builder: KingComposer \< 2.9.4 - Stored Cross-Site Scripting (CVSS 5.5, kingthemes Page Builder: KingComposer – Free Drag and Drop…)
- [CVE-2019-25139](https://cve.now/CVE-2019-25139.md): Coming Soon Page & Maintenance Mode \<= 1.8.1 - Unauthenticated Settings Reset (CVSS 6.5, wpshopmart Coming Soon Page & Maintenance Mode)
- [CVE-2021-4354](https://cve.now/CVE-2021-4354.md): PWA for WP & AMP \<= 1.7.32 - Arbitrary File Upload (CVSS 8.8, magazine3 PWA for WP – Progressive Web Apps Made Simple)
- [CVE-2020-36708](https://cve.now/CVE-2020-36708.md): Epsilon Framework Themes (Various Versions) - Function Injection (CVSS 9.8, machothemes Antreas · machothemes NatureMag Lite +14)
- [CVE-2019-25138](https://cve.now/CVE-2019-25138.md): User Submitted Posts \<= 20190312 - Unauthenticated Arbitrary File Upload (CVSS 9.8, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2020-36707](https://cve.now/CVE-2020-36707.md): Coming Soon & Maintenance Mode Page \<= 1.57 - Cross-Site Request Forgery (CVSS 8.8, hookandhook Coming Soon & Maintenance Mode Page & Under Con…)
- [CVE-2021-4352](https://cve.now/CVE-2021-4352.md): JobSearch WP Job Board \<= 1.8.1 - Missing Authorization to Settings Change (CVSS 5.3, eyecix JobSearch WP Job Board)
- [CVE-2023-3124](https://cve.now/CVE-2023-3124.md): Elementor Pro \<= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update\_page\_option (CVSS 8.8, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2021-4351](https://cve.now/CVE-2021-4351.md): Frontend File Manager \<= 18.2 - Unauthenticated Post Meta Change (CVSS 5.8, nmedia Frontend File Manager Plugin)
- [CVE-2020-36704](https://cve.now/CVE-2020-36704.md): Fruitful \< 3.8.2 - Stored Cross-Site Scripting (CVSS 6.4, fruitfulcode Fruitful)
- [CVE-2021-4350](https://cve.now/CVE-2021-4350.md): Frontend File Manager \<= 18.2 - Unauthenticated HTML Injection leading to Spam Emails (CVSS 7.2, nmedia Frontend File Manager Plugin)
- [CVE-2020-36701](https://cve.now/CVE-2020-36701.md): Page Builder: KingComposer \< 2.9.4 - Arbitrary File Upload (CVSS 8.8, kingthemes Page Builder: KingComposer – Free Drag and Drop…)
- [CVE-2021-4345](https://cve.now/CVE-2021-4345.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion (CVSS 6.5, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2020-36702](https://cve.now/CVE-2020-36702.md): Spectra – WordPress Gutenberg Blocks \<= 1.14.7 - Missing Authorization (CVSS 5.5, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2020-36703](https://cve.now/CVE-2020-36703.md): Elementor Website Builder \<= 2.9.7 - Authenticated Stored Cross-Site Scripting (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2021-4346](https://cve.now/CVE-2021-4346.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Account Changes (CVSS 9.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2021-4347](https://cve.now/CVE-2021-4347.md): Advanced Shipment Tracking for WooCommerce \<= 3.2.6 - Authenticated WordPress Options Change (CVSS 9.9, zorem Advanced Shipment Tracking for WooCommerce)
- [CVE-2021-4348](https://cve.now/CVE-2021-4348.md): Ultimate GDPR & CCPA \<= 2.4 - Unauthenticated Settings Import & Export (CVSS 7.5, createit-pl Ultimate GDPR & CCPA Compliance Toolkit for Wor…)
- [CVE-2021-4349](https://cve.now/CVE-2021-4349.md): Process Steps Template Designer \<= 1.2.1 - Cross-Site Request Forgery (CVSS 8.8, narinder-singh Process Steps Template Designer)
- [CVE-2021-4344](https://cve.now/CVE-2021-4344.md): Frontend File Manager \<= 18.2 - Privilege Escalation (CVSS 6.4, nmedia Frontend File Manager Plugin)
- [CVE-2021-4343](https://cve.now/CVE-2021-4343.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Account Creation (CVSS 9.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2020-36700](https://cve.now/CVE-2020-36700.md): Page Builder: KingComposer \< 2.9.4 - Authorization Bypass due to Improper Access Control (CVSS 8.8, kingthemes Page Builder: KingComposer – Free Drag and Drop…)
- [CVE-2021-4341](https://cve.now/CVE-2021-4341.md): uListing \<= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX (CVSS 9.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2020-36699](https://cve.now/CVE-2020-36699.md): Quick Page/Post Redirect Plugin \<= 5.1.9 - Redirect Security Bypass (CVSS 4.3, anadnet Quick Page/Post Redirect Plugin)
- [CVE-2021-4340](https://cve.now/CVE-2021-4340.md): uListing \<= 1.6.6 - Unauthenticated SQL Injection (CVSS 9.8, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2021-4339](https://cve.now/CVE-2021-4339.md): uListing \<= 1.6.6 - Unauthenticated Information Disclosure (CVSS 7.5, stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2021-4338](https://cve.now/CVE-2021-4338.md): 404 to 301 \<= 3.0.7 - Missing Authorization to Redirect Creation (CVSS 6.4, joelcj91 404 to 301 – Redirect, Log and Notify 404 Errors)
- [CVE-2020-36697](https://cve.now/CVE-2020-36697.md): WP GDPR \<= 2.1.1 - Missing Authorization Checks (CVSS 7.3, koenhuybrechts WP GDPR)
- [CVE-2020-36696](https://cve.now/CVE-2020-36696.md): Product Input Fields for WooCommerce \<= 1.2.6 - Missing Authorization (CVSS 7.5, tychesoftwares Product Input Fields for WooCommerce)
- [CVE-2021-33223](https://cve.now/CVE-2021-33223.md): An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php fil (no CVSS)
- [CVE-2021-46889](https://cve.now/CVE-2021-46889.md): The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme\_id for bwg\_frontend\_data. (no CVSS)
- [CVE-2022-25834](https://cve.now/CVE-2022-25834.md): In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected c (no CVSS)
- [CVE-2022-31693](https://cve.now/CVE-2022-31693.md): VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. (CVSS 5.5)
- [CVE-2023-0121](https://cve.now/CVE-2023-0121.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2023-0508](https://cve.now/CVE-2023-0508.md): Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab (CVSS 3.1, GitLab)
- [CVE-2023-1825](https://cve.now/CVE-2023-1825.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 3.1, GitLab)
- [CVE-2023-2001](https://cve.now/CVE-2023-2001.md): An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver (CVSS 4.3, GitLab)
- [CVE-2023-2013](https://cve.now/CVE-2023-2013.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 befor (CVSS 2.6, GitLab)
- [CVE-2023-2015](https://cve.now/CVE-2023-2015.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 befo (CVSS 4.4, GitLab)
- [CVE-2023-2198](https://cve.now/CVE-2023-2198.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 befor (CVSS 7.5, GitLab)
- [CVE-2023-2199](https://cve.now/CVE-2023-2199.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 befo (CVSS 7.5, GitLab)
- [CVE-2023-2442](https://cve.now/CVE-2023-2442.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 befo (CVSS 8.7, GitLab)
- [CVE-2023-2485](https://cve.now/CVE-2023-2485.md): Incorrect Privilege Assignment in GitLab (CVSS 4.4, GitLab)
- [CVE-2023-2530](https://cve.now/CVE-2023-2530.md): A privilege escalation allowing remote code execution was discovered in the orchestration service. (no CVSS, Puppet Enterprise)
- [CVE-2023-2589](https://cve.now/CVE-2023-2589.md): An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before (CVSS 5.9, GitLab)
- [CVE-2023-30400](https://cve.now/CVE-2023-30400.md): An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. (CVSS 9.8)
- [CVE-2023-31114](https://cve.now/CVE-2023-31114.md): An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. (CVSS 9.1)
- [CVE-2023-31115](https://cve.now/CVE-2023-31115.md): An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. (CVSS 7.5)
- [CVE-2023-31116](https://cve.now/CVE-2023-31116.md): An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. (CVSS 9.8)
- [CVE-2023-3142](https://cve.now/CVE-2023-3142.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 3.8, microweber/microweber)
- [CVE-2023-33282](https://cve.now/CVE-2023-33282.md): Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. (CVSS 9.1)
- [CVE-2023-33283](https://cve.now/CVE-2023-33283.md): Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. (CVSS 5.5)
- [CVE-2023-33284](https://cve.now/CVE-2023-33284.md): Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. (CVSS 8.8)
- [CVE-2023-33496](https://cve.now/CVE-2023-33496.md): xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.Ne (CVSS 9.8, com.xuxueli:xxl-rpc-core)
- [CVE-2023-33498](https://cve.now/CVE-2023-33498.md): alist \<=3.16.3 is vulnerable to Incorrect Access Control. (CVSS 8.8, github.com/alist-org/alist/v3)
- [CVE-2023-33510](https://cve.now/CVE-2023-33510.md): Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters. (CVSS 7.5, org.jeecgframework.p3:jeecg-p3-biz-chat)
- [CVE-2023-33536](https://cve.now/CVE-2023-33536.md): TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/WlanMa (CVSS 8.1)
- [CVE-2023-33537](https://cve.now/CVE-2023-33537.md): TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMap (CVSS 8.1)
- [CVE-2023-33538](https://cve.now/CVE-2023-33538.md): TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component (CVSS 8.8, KEV)
- [CVE-2023-33553](https://cve.now/CVE-2023-33553.md): An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipul (CVSS 9.8)
- [CVE-2023-33556](https://cve.now/CVE-2023-33556.md): TOTOLink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/se (CVSS 9.8)
- [CVE-2023-33595](https://cve.now/CVE-2023-33595.md): CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii\_decode at /Objects/unicodeobject.c. (no CVSS)
- [CVE-2023-33601](https://cve.now/CVE-2023-33601.md): An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP (CVSS 8.8)
- [CVE-2023-33604](https://cve.now/CVE-2023-33604.md): Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php. (CVSS 9.1)
- [CVE-2023-33781](https://cve.now/CVE-2023-33781.md): An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file. (CVSS 8.8)
- [CVE-2023-33782](https://cve.now/CVE-2023-33782.md): D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function. (CVSS 8.8)
- [CVE-2023-33863](https://cve.now/CVE-2023-33863.md): SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. (CVSS 9.8)
- [CVE-2023-33864](https://cve.now/CVE-2023-33864.md): StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. (CVSS 9.8)
- [CVE-2023-33865](https://cve.now/CVE-2023-33865.md): RenderDoc before 1.27 allows local privilege escalation via a symlink attack. (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.