# CVEs published 2023-06-20

64 CVEs were published on June 20, 2023: 12 critical, 22 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-33869](https://cve.now/CVE-2023-33869.md): Enphase Envoy OS Command Injection (CVSS 6.3, Enphase Envoy)
- [CVE-2023-32274](https://cve.now/CVE-2023-32274.md): Enphase Installer Toolkit Android App Use of Hard-coded Credentials (CVSS 8.6, Enphase Installer Toolkit)
- [CVE-2023-35166](https://cve.now/CVE-2023-35166.md): Privilege escalation (PR) from account through TipsPanel (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-help-ui)
- [CVE-2023-2400](https://cve.now/CVE-2023-2400.md): Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view use (CVSS 2.7, Devolutions Server)
- [CVE-2023-3340](https://cve.now/CVE-2023-3340.md): SourceCodester Online School Fees System GET Parameter ajx.php sql injection (CVSS 6.3, SourceCodester Online School Fees System)
- [CVE-2023-2533](https://cve.now/CVE-2023-2533.md): PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF (CVSS 8.4, KEV, PaperCut NG/MF)
- [CVE-2023-35095](https://cve.now/CVE-2023-35095.md): WordPress Flo Forms Plugin \<= 1.0.40 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Flothemes Flo Forms – Easy Drag & Drop Form Builder)
- [CVE-2023-3337](https://cve.now/CVE-2023-3337.md): PuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authentication (CVSS 7.3, PuneethReddyHC Online Shopping System Advanced)
- [CVE-2023-1999](https://cve.now/CVE-2023-1999.md): Use after free in libwebp (CVSS 5.3, Chromium libwebp)
- [CVE-2023-35097](https://cve.now/CVE-2023-35097.md): WordPress WP Affiliate Links Plugin \<= 0.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Internet Marketing Dojo WP Affiliate Links)
- [CVE-2023-35098](https://cve.now/CVE-2023-35098.md): WordPress NextGen GalleryView Plugin \<= 0.5.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, John Brien WordPress NextGen GalleryView)
- [CVE-2023-1862](https://cve.now/CVE-2023-1862.md): Remote access to warp-svc.exe in Cloudflare WARP (CVSS 7.3, Cloudflare WARP Client)
- [CVE-2023-35878](https://cve.now/CVE-2023-35878.md): WordPress Extra User Details Plugin \<= 0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Vadym K. Extra User Details)
- [CVE-2023-35882](https://cve.now/CVE-2023-35882.md): WordPress Super Socializer Plugin \<= 7.13.52 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Team Heateor Super Socializer)
- [CVE-2023-26436](https://cve.now/CVE-2023-26436.md): Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during de (CVSS 7.1, OX Software OX App Suite)
- [CVE-2023-26435](https://cve.now/CVE-2023-26435.md): It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. (CVSS 5.0, OX Software OX App Suite)
- [CVE-2023-26434](https://cve.now/CVE-2023-26434.md): When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. (CVSS 4.3, OX Software OX App Suite)
- [CVE-2023-26433](https://cve.now/CVE-2023-26433.md): When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. (CVSS 4.3, OX Software OX App Suite)
- [CVE-2023-26432](https://cve.now/CVE-2023-26432.md): When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. (CVSS 4.3, OX Software OX App Suite)
- [CVE-2023-26431](https://cve.now/CVE-2023-26431.md): IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. (CVSS 5.0, OX Software OX App Suite)
- [CVE-2023-26429](https://cve.now/CVE-2023-26429.md): Control characters were not removed when exporting user feedback content. (CVSS 3.5, OX Software OX App Suite)
- [CVE-2023-26428](https://cve.now/CVE-2023-26428.md): Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. (CVSS 6.5, OX Software OX App Suite)
- [CVE-2023-26427](https://cve.now/CVE-2023-26427.md): Default permissions for a properties file were too permissive. (CVSS 3.2, OX Software OX App Suite)
- [CVE-2023-35884](https://cve.now/CVE-2023-35884.md): WordPress EventPrime Plugin \<= 3.0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, EventPrime)
- [CVE-2023-3325](https://cve.now/CVE-2023-3325.md): CMS Commander \<= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature (CVSS 8.1, thoefter CMS Commander – Manage Multiple Sites)
- [CVE-2023-3320](https://cve.now/CVE-2023-3320.md): The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. (CVSS 6.1, musilda WP Sticky Social)
- [CVE-2020-20067](https://cve.now/CVE-2020-20067.md): File upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via the upload type parameter. (CVSS 8.8)
- [CVE-2020-20070](https://cve.now/CVE-2020-20070.md): Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld paramete (CVSS 6.1)
- [CVE-2020-20335](https://cve.now/CVE-2020-20335.md): Buffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote attacker to cause a den (CVSS 7.5)
- [CVE-2020-20413](https://cve.now/CVE-2020-20413.md): SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in ad (CVSS 9.8)
- [CVE-2020-20491](https://cve.now/CVE-2020-20491.md): SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function (CVSS 7.2)
- [CVE-2020-20502](https://cve.now/CVE-2020-20502.md): Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function. (CVSS 6.5)
- [CVE-2020-20636](https://cve.now/CVE-2020-20636.md): SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of th (CVSS 7.5)
- [CVE-2020-20697](https://cve.now/CVE-2020-20697.md): Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivie (CVSS 4.8, khodakhah/nodcms)
- [CVE-2020-20703](https://cve.now/CVE-2020-20703.md): Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter. (CVSS 9.8)
- [CVE-2020-20718](https://cve.now/CVE-2020-20718.md): File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to t (CVSS 9.8)
- [CVE-2020-20725](https://cve.now/CVE-2020-20725.md): Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via the name field in ad (CVSS 6.1)
- [CVE-2020-20726](https://cve.now/CVE-2020-20726.md): Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update\_rows/ (CVSS 8.8, gilacms/gila)
- [CVE-2020-20735](https://cve.now/CVE-2020-20735.md): File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter. (CVSS 9.8)
- [CVE-2020-20918](https://cve.now/CVE-2020-20918.md): An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php (CVSS 7.2)
- [CVE-2020-20919](https://cve.now/CVE-2020-20919.md): File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via (CVSS 7.2)
- [CVE-2020-20969](https://cve.now/CVE-2020-20969.md): File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan\_restoreitem.php file. (CVSS 7.2)
- [CVE-2020-21052](https://cve.now/CVE-2020-21052.md): Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of th (CVSS 6.1)
- [CVE-2020-21058](https://cve.now/CVE-2020-21058.md): Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax. (CVSS 6.1)
- [CVE-2020-21174](https://cve.now/CVE-2020-21174.md): File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function. (CVSS 9.8, feehi/cms)
- [CVE-2020-21246](https://cve.now/CVE-2020-21246.md): Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function. (CVSS 5.4, sheng/yiicms)
- [CVE-2020-21252](https://cve.now/CVE-2020-21252.md): Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges v (CVSS 8.8)
- [CVE-2020-21268](https://cve.now/CVE-2020-21268.md): Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parame (CVSS 6.1)
- [CVE-2020-21325](https://cve.now/CVE-2020-21325.md): An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set\_chache method of the function\\common.func.php f (CVSS 8.8)
- [CVE-2020-21366](https://cve.now/CVE-2020-21366.md): Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php. (CVSS 8.0)
- [CVE-2020-21400](https://cve.now/CVE-2020-21400.md): SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modi (CVSS 7.2)
- [CVE-2020-21474](https://cve.now/CVE-2020-21474.md): File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rs (CVSS 9.8)
- [CVE-2020-21485](https://cve.now/CVE-2020-21485.md): Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the brow (CVSS 6.1, org.alluxio:alluxio-parent)
- [CVE-2020-21486](https://cve.now/CVE-2020-21486.md): SQL injection vulnerability in PHPOK v.5.4. (CVSS 7.5)
- [CVE-2020-21489](https://cve.now/CVE-2020-21489.md): File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupd (CVSS 9.8, feehi/cms)
- [CVE-2023-3220](https://cve.now/CVE-2023-3220.md): An issue was discovered in the Linux kernel through 6.1-rc8. (CVSS 5.5, Linux kernel)
- [CVE-2023-33495](https://cve.now/CVE-2023-33495.md): Craft CMS through 4.4.9 is vulnerable to HTML Injection. (CVSS 6.1, craftcms/cms)
- [CVE-2023-34541](https://cve.now/CVE-2023-34541.md): Langchain 0.0.171 is vulnerable to Arbitrary code execution in load\_prompt. (CVSS 9.8, langchain)
- [CVE-2023-34563](https://cve.now/CVE-2023-34563.md): netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication. (CVSS 9.8)
- [CVE-2023-34596](https://cve.now/CVE-2023-34596.md): A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message. (CVSS 6.5)
- [CVE-2023-34597](https://cve.now/CVE-2023-34597.md): A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message. (CVSS 6.5)
- [CVE-2023-34600](https://cve.now/CVE-2023-34600.md): Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2023-35854](https://cve.now/CVE-2023-35854.md): Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session (no CVSS)
- [CVE-2023-35885](https://cve.now/CVE-2023-35885.md): CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.