# CVEs published 2023-07-15 12 CVEs were published on July 15, 2023: 1 critical, 2 high. Days are UTC. - [CVE-2023-2507](https://cve.now/CVE-2023-2507.md): CleverTap Cordova Plugin 2.6.2 - Reflected XSS (CVSS 9.3, CleverTap Cordova Plugin ยท clevertap-cordova) - [CVE-2023-30791](https://cve.now/CVE-2023-30791.md): Plane 0.7.1 - Insecure file upload (CVSS 7.1, Plane) - [CVE-2023-2268](https://cve.now/CVE-2023-2268.md): Plane v0.7.1 - Unauthorized access to files (CVSS 7.1, Plane) - [CVE-2023-3682](https://cve.now/CVE-2023-3682.md): Nesote Inout Blockchain EasyPayments POST Parameter getcoinaddress sql injection (CVSS 6.3, Nesote Inout Blockchain EasyPayments) - [CVE-2023-3681](https://cve.now/CVE-2023-3681.md): Campcodes Retro Cellphone Online Store modal\_add\_product.php cross site scripting (CVSS 3.5, Campcodes Retro Cellphone Online Store) - [CVE-2023-3680](https://cve.now/CVE-2023-3680.md): SourceCodester Lost and Found Information System HTTP POST Request sql injection (CVSS 6.3, SourceCodester Lost and Found Information System) - [CVE-2023-3679](https://cve.now/CVE-2023-3679.md): SourceCodester Lost and Found Information System HTTP POST Request sql injection (CVSS 6.3, SourceCodester Lost and Found Information System) - [CVE-2023-3678](https://cve.now/CVE-2023-3678.md): SourceCodester AC Repair and Services System HTTP POST Request sql injection (CVSS 6.3, SourceCodester AC Repair and Services System) - [CVE-2021-31294](https://cve.now/CVE-2021-31294.md): Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specificall (no CVSS) - [CVE-2023-35802](https://cve.now/CVE-2023-35802.md): IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploit (no CVSS) - [CVE-2023-38349](https://cve.now/CVE-2023-38349.md): PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. (no CVSS) - [CVE-2023-38350](https://cve.now/CVE-2023-38350.md): PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-07-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.