CVEs published June 23, 2023
191 CVEs were published on June 23, 2023: 15 critical, 27 high. 6 are now in CISA KEV.
- Published
- 191
- Critical
- 15
- High
- 27
- Medium
- 57
- Low
- 8
- Unrated
- 84
- Now in CISA KEV
- 6
- Fix available
- 105
Most affected products
- Dell CPG BIOS
- 30
- Apple macOS
- 19
- Apple macOS · Apple watchOS +2
- 19
- Apple macOS · Apple iOS and iPadOS
- 6
- Apple macOS · Apple watchOS +1
- 6
- Apple macOS · Apple iOS and iPadOS +1
- 5
- Apple macOS · Apple Safari +3
- 5
- nextcloud security-advisories
- 5
- Apple iOS and iPadOS
- 4
- admidio/admidio
- 3
Critical 15
- CVE-2023-1721Yoga Class Registration System 1.0 - RCEYoga Class Registration System
- CVE-2023-35169php-imap vulnerable to RCE through a directory traversal vulnerabilityWebklex php-imap · webklex/php-imap +1
- CVE-2023-35162XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions templatexwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2023-35161XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication pagexwiki-platform · org.xwiki.platform:xwiki-platform-appwithi…
- CVE-2023-35160XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit templatexwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2023-35159XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace templatexwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2023-35158XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore templatexwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2023-35156XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete templatexwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2023-35153XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parametersxwiki-platform · org.xwiki.platform:xwiki-platform-appwithi…
- CVE-2023-35152XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResultsxwiki-platform · org.xwiki.platform:xwiki-platform-like-ui
- CVE-2023-35150XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationxwiki-platform · org.xwiki.platform:xwiki-platform-invitati…
- CVE-2023-34465XWiki Platform's Mail.MailConfig can be edited by any user with edit rightsxwiki-platform · org.xwiki.platform:xwiki-platform-mail-sen…
- CVE-2023-34464XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent templatexwiki-platform · org.xwiki.platform:xwiki-platform-web +1
- CVE-2023-33299A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attackFortinet FortiNAC
- CVE-2023-30258Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenti
High 27
- CVE-2023-35932jcvi vulnerable to Configuration Injection due to unsanitized user input tanghaibao jcvi · jcvi
- CVE-2023-35928Nextcloud user scoped external storage can be used to gather credentials of other usersnextcloud security-advisories
- CVE-2023-35927Nextcloud system addressbooks can be modified by malicious trusted servernextcloud security-advisories
- CVE-2023-35172Nextcloud Server password reset endpoint is not brute force protectednextcloud security-advisories
- CVE-2023-35154Knowage-Server vulnerable to account validation bypassKnowageLabs Knowage-Server
- CVE-2023-34254Remote inventory task command injection when using ssh command modeglpi-project glpi-agent
- CVE-2023-35157XWiki Platform vulnerable to reflected cross-site scripting via delattachment actionxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-35155XWiki Platform vulnerable to cross-site scripting in target parameter via share page by emailxwiki-platform · org.xwiki.platform:xwiki-platform-sharepag…
- CVE-2023-3393Code Injection in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-25518 NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allow an attacker with pNVIDIA Jetson AGX Xavier series, Jetson Xavier NX
- CVE-2023-25515 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data is parsed, which may lead to codNVIDIA GPU Display Driver for Windows and Linux
- CVE-2023-35151XWiki Platform may show email addresses in clear in REST resultsxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2023-34467XWiki Platform may retrieve email addresses of all users xwiki-platform · org.xwiki.platform:xwiki-platform-livetabl…
- CVE-2022-47614WordPress MStore API Plugin <= 3.9.7 is vulnerable to SQL InjectionInspireUI MStore API
- CVE-2023-29100WordPress The7 Theme <= 11.6.0 is vulnerable to Cross Site Scripting (XSS)Dream-Theme The7
- CVE-2023-34021WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)Andy Moyle Church Admin
- CVE-2023-34012WordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)Premium Addons for Elementor Premium Addons PRO
- CVE-2023-28073 Dell BIOS contains an improper authentication vulnerability.Dell CPG BIOS
- CVE-2023-31469Apache StreamPipes: Privilege escalation through non-admin userApache Software Foundation Apache StreamPipes · org.apache.…
- CVE-2023-33141Yet Another Reverse Proxy (YARP) Denial of Service VulnerabilityMicrosoft YARP · Yarp.ReverseProxy
- CVE-2023-32373A use-after-free issue was addressed with improved memory management.Apple macOS · Apple Safari +3
- CVE-2023-32409The issue was addressed with improved bounds checks.Apple macOS · Apple Safari +3
- CVE-2023-32434An integer overflow was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-32435A memory corruption issue was addressed with improved state management.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-32439A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-3317A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in wifi mt76/mt7921 sKernel
- CVE-2023-36272LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c.
Medium, low and unrated 149
- CVE-2023-1783OrangeScrum 2.0.11 - AWS Credentials Leak via PDF RenderingOrangescrum
- CVE-2023-35173End-to-End encrypted file-drops can be made inaccessiblenextcloud security-advisories
- CVE-2023-35171Nextcloud Server vulnerable to open redirect on "Unsupported browser" warningnextcloud security-advisories
- CVE-2023-35165AWS CDK EKS overly permissive trust policiesaws-cdk · aws-cdk-lib +1
- CVE-2023-35163Vega's validators able to submit duplicate transactions vegaprotocol vega · code.vegaprotocol.io/vega
- CVE-2023-35931Shescape potential environment variable exposure on Windows with CMDericcornelissen shescape · shescape
- CVE-2023-34460Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfilestauri-apps tauri · tauri
- CVE-2023-35167When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Idremult
- CVE-2023-3394Session Fixation in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-25520 NVIDIA Jetson Linux Driver Package contains a vulnerability in nvbootctrl, where a privileged local attacker can configure invalid settingsNVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2023-3391SourceCodester Human Resource Management System detailview.php sql injectionSourceCodester Human Resource Management System
- CVE-2023-34466XWiki Platform's tags on non-viewable pages can be revealed to usersxwiki-platform · org.xwiki.platform:xwiki-platform-tag-api
- CVE-2023-35925FastAsyncWorldEdit vulnerable to Uncontrolled Resource ConsumptionIntellectualSites FastAsyncWorldEdit · com.fastasyncworl… +1
- CVE-2023-23679WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)JS Help Desk
- CVE-2023-28751WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)Wpmet Wp Ultimate Review
- CVE-2023-27427WordPress CRM Memberships Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)NTZApps CRM Memberships
- CVE-2023-32580WordPress Password Protected Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)WPExperts Password Protected
- CVE-2023-35048WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)MagePeople Team Booking and Rental Manager for Bike
- CVE-2023-28065 Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / MountDell Command Update
- CVE-2023-28064 Dell BIOS contains an Out-of-bounds Write vulnerability.Dell CPG BIOS
- CVE-2023-32480 Dell BIOS contains an Improper Input Validation vulnerability.Dell CPG BIOS
- CVE-2023-28071 Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / Dell Command Update
- CVE-2023-28058 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28050 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28026 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28044 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28060 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-25938 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28031 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28034 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28027 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28036 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-3383SourceCodester Game Result Matrix System GET Parameter athlete-profile.php sql injectionSourceCodester Game Result Matrix System
- CVE-2023-3382SourceCodester Game Result Matrix System GET Parameter save-delegates.php cross site scriptingSourceCodester Game Result Matrix System
- CVE-2023-28032 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28028 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28039 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28040 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28056 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28030 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-25937 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28033 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28035 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-3381SourceCodester Online School Fees System GET Parameter datatable.php cross site scriptingSourceCodester Online School Fees System
- CVE-2023-3380Wavlink WN579X3 Ping Test adm.cgi injectionWavlink WN579X3
- CVE-2023-28041 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28042 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28061 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28059 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28029 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28054 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-28052 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-25936 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2023-32464 Dell VxRail, versions prior to 7.0.450, contain an improper certificate validation vulnerability.Dell EMC VxRail Appliance
- CVE-2023-32463 Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality.Dell EMC VxRail Appliance
- CVE-2023-23344HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorizationHCL Software HCL BigFix WebUI Insights
- CVE-2022-22630A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2022-42792This issue was addressed with improved data protection.Apple iOS and iPadOS
- CVE-2022-42807A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-42834An access issue was addressed with improved access restrictions.Apple macOS
- CVE-2022-42860This issue was addressed with improved checks to prevent unauthorized actions.Apple macOS
- CVE-2022-46715A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2022-46718A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2023-23516The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-23539A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2023-25003A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulneraAutoCAD, Maya
- CVE-2023-27908A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and cAutodesk installer
- CVE-2023-27930A type confusion issue was addressed with improved checks.Apple macOS · Apple watchOS +2
- CVE-2023-27940The issue was addressed with additional permissions checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-27964An authentication issue was addressed with improved state management.Apple AirPods Firmware Update E
- CVE-2023-28191This issue was addressed with improved redaction of sensitive information.Apple macOS · Apple watchOS +2
- CVE-2023-28202This issue was addressed with improved state management.Apple macOS · Apple watchOS +2
- CVE-2023-28204An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple Safari +3
- CVE-2023-29860An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via
- CVE-2023-30260Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POSTbillz/raspap-webgui
- CVE-2023-30362Buffer Overflow vulnerability in coap_send function in libcoap library 4.3.1-103-g52cfd56 fixed in 4.3.1-120-ge242200 allows attackers to ob
- CVE-2023-3212A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel.Linux kernel
- CVE-2023-32351A logic issue was addressed with improved checks.Apple iTunes for Windows
- CVE-2023-32352A logic issue was addressed with improved checks.Apple macOS · Apple watchOS +1
- CVE-2023-32353A logic issue was addressed with improved checks.Apple iTunes for Windows
- CVE-2023-32354An out-of-bounds read was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2023-32355A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-32357An authorization issue was addressed with improved state management.Apple macOS · Apple watchOS +2
- CVE-2023-32360An authentication issue was addressed with improved state management.Apple macOS
- CVE-2023-32363A permissions issue was addressed by removing vulnerable code and adding additional checks.Apple macOS
- CVE-2023-32365The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-32367This issue was addressed with improved entitlements.Apple macOS · Apple iOS and iPadOS
- CVE-2023-32368An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple watchOS +2
- CVE-2023-32369A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-32371The issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-32372An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple watchOS +2
- CVE-2023-32375An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2023-32376This issue was addressed with improved entitlements.Apple macOS · Apple watchOS +2
- CVE-2023-32380An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2023-32382An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2023-32384A buffer overflow was addressed with improved bounds checking.Apple macOS · Apple watchOS +2
- CVE-2023-32385A denial-of-service issue was addressed with improved memory handling.Apple macOS · Apple iOS and iPadOS
- CVE-2023-32386A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2023-32387A use-after-free issue was addressed with improved memory management.Apple macOS
- CVE-2023-32388A privacy issue was addressed with improved private data redaction for log entries.Apple macOS · Apple watchOS +1
- CVE-2023-32389This issue was addressed with improved redaction of sensitive information.Apple macOS · Apple watchOS +2
- CVE-2023-32390The issue was addressed with improved checks.Apple macOS · Apple watchOS +1
- CVE-2023-32391The issue was addressed with improved checks.Apple macOS · Apple watchOS +1
- CVE-2023-32392A privacy issue was addressed with improved private data redaction for log entries.Apple macOS · Apple watchOS +2
- CVE-2023-32394The issue was addressed with improved checks.Apple macOS · Apple watchOS +2
- CVE-2023-32395A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-32397A logic issue was addressed with improved state management.Apple macOS · Apple iOS and iPadOS
- CVE-2023-32398A use-after-free issue was addressed with improved memory management.Apple macOS · Apple watchOS +2
- CVE-2023-32399The issue was addressed with improved handling of caches.Apple macOS · Apple watchOS +2
- CVE-2023-32400This issue was addressed with improved checks.Apple macOS · Apple watchOS +1
- CVE-2023-32402An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple Safari +3
- CVE-2023-32403This issue was addressed with improved redaction of sensitive information.Apple macOS · Apple watchOS +2
- CVE-2023-32404This issue was addressed with improved entitlements.Apple macOS · Apple watchOS +1
- CVE-2023-32405A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-32407A logic issue was addressed with improved state management.Apple macOS · Apple watchOS +2
- CVE-2023-32408The issue was addressed with improved handling of caches.Apple macOS · Apple watchOS +2
- CVE-2023-32410An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS
- CVE-2023-32411This issue was addressed with improved entitlements.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-32412A use-after-free issue was addressed with improved memory management.Apple macOS · Apple watchOS +2
- CVE-2023-32413A race condition was addressed with improved state handling.Apple macOS · Apple watchOS +2
- CVE-2023-32414The issue was addressed with improved checks.Apple macOS
- CVE-2023-32415This issue was addressed with improved redaction of sensitive information.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-32417This issue was addressed by restricting options offered on a locked device.Apple watchOS
- CVE-2023-32419The issue was addressed with improved bounds checks.Apple iOS and iPadOS
- CVE-2023-32420An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple watchOS +2
- CVE-2023-32422This issue was addressed by adding additional SQLite logging restrictions.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-32423A buffer overflow issue was addressed with improved memory handling.Apple macOS · Apple Safari +3
- CVE-2023-3302Improper Neutralization of Formula Elements in a CSV File in admidio/admidioadmidio/admidio
- CVE-2023-3303Improper Access Control in admidio/admidioadmidio/admidio
- CVE-2023-3304Improper Access Control in admidio/admidioadmidio/admidio
- CVE-2023-34188The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers.
- CVE-2023-34203In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could pe
- CVE-2023-34671Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's ro
- CVE-2023-34672Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting u
- CVE-2023-34673Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploi
- CVE-2023-35759In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input.
- CVE-2023-35801A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a netwo
- CVE-2023-36192Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.
- CVE-2023-36193Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- CVE-2023-36271LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c.
- CVE-2023-36273LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c.
- CVE-2023-36274LibreDWG v0.11 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c.
- CVE-2023-36284An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remo
- CVE-2023-36287An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cook
- CVE-2023-36288An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cook
- CVE-2023-36289An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cook
- CVE-2023-36345A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.
- CVE-2023-36346POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.
- CVE-2023-36348POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.