# CVEs published 2023-08-05

26 CVEs were published on August 5, 2023: 1 critical, 5 high. Days are UTC.

- [CVE-2023-32600](https://cve.now/CVE-2023-32600.md): WordPress Rank Math SEO Plugin \<= 1.0.119 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Rank Math SEO)
- [CVE-2023-4172](https://cve.now/CVE-2023-4172.md): Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx absolute path traversal (CVSS 4.3, Chengdu Flash Flood Disaster Monitoring and Warning System)
- [CVE-2023-34010](https://cve.now/CVE-2023-34010.md): WordPress Media Library Assistant Plugin \<= 3.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, David Lingren Media Library Assistant)
- [CVE-2023-34377](https://cve.now/CVE-2023-34377.md): WordPress My Content Management Plugin \<= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Joseph C Dolson My Content Management)
- [CVE-2023-36678](https://cve.now/CVE-2023-36678.md): WordPress WP Content Copy Protection & No Right Click Plugin \<= 3.5.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WP-buy WP Content Copy Protection & No Right Click)
- [CVE-2023-30491](https://cve.now/CVE-2023-30491.md): WordPress CodeBard's Patron Button and Widgets for Patreon Plugin \<= 2.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, CodeBard's Patron Button and Widgets for Patreon)
- [CVE-2023-36686](https://cve.now/CVE-2023-36686.md): WordPress CartFlows Pro Plugin \<= 1.11.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, CartFlows Pro)
- [CVE-2023-36689](https://cve.now/CVE-2023-36689.md): WordPress WPFactory Helper Plugin \<= 1.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPFactory Helper)
- [CVE-2023-37873](https://cve.now/CVE-2023-37873.md): WordPress WooCommerce Ship to Multiple Addresses Plugin \<= 3.8.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WooCommerce Shipping Multiple Addresses)
- [CVE-2023-37874](https://cve.now/CVE-2023-37874.md): WordPress HTTP Headers Plugin \<= 1.18.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Dimitar Ivanov HTTP Headers)
- [CVE-2023-4171](https://cve.now/CVE-2023-4171.md): Chengdu Flash Flood Disaster Monitoring and Warning System FileDownload.ashx path traversal (CVSS 4.3, Chengdu Flash Flood Disaster Monitoring and Warning System)
- [CVE-2023-4189](https://cve.now/CVE-2023-4189.md): Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 (CVSS 4.8, instantsoft/icms2)
- [CVE-2023-4188](https://cve.now/CVE-2023-4188.md): SQL Injection in instantsoft/icms2 (CVSS 9.8, instantsoft/icms2)
- [CVE-2023-4170](https://cve.now/CVE-2023-4170.md): DedeBIZ Article cross site scripting (CVSS 3.5, DedeBIZ)
- [CVE-2023-4169](https://cve.now/CVE-2023-4169.md): Ruijie RG-EW1200G Administrator Password set\_passwd access control (CVSS 6.3, Ruijie RG-EW1200G)
- [CVE-2023-4168](https://cve.now/CVE-2023-4168.md): Templatecookie Adlisting Redirect ad-list information disclosure (CVSS 4.3, Templatecookie Adlisting)
- [CVE-2023-4187](https://cve.now/CVE-2023-4187.md): Cross-site Scripting (XSS) - Stored in instantsoft/icms2 (CVSS 3.5, instantsoft/icms2)
- [CVE-2023-4167](https://cve.now/CVE-2023-4167.md): Media Browser Emby Server cross site scripting (CVSS 3.5, Media Browser Emby Server)
- [CVE-2023-4166](https://cve.now/CVE-2023-4166.md): Tongda OA delete\_log.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-4165](https://cve.now/CVE-2023-4165.md): Tongda OA delete\_seal.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-39508](https://cve.now/CVE-2023-39508.md): Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2020-23564](https://cve.now/CVE-2020-23564.md): File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS\_Upfile.php. (no CVSS)
- [CVE-2022-46782](https://cve.now/CVE-2022-46782.md): An issue was discovered in Stormshield SSL VPN Client before 3.2.0. (no CVSS)
- [CVE-2023-33367](https://cve.now/CVE-2023-33367.md): A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the (no CVSS)
- [CVE-2023-36095](https://cve.now/CVE-2023-36095.md): An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affec (no CVSS, langchain)
- [CVE-2023-38943](https://cve.now/CVE-2023-38943.md): ShuiZe\_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.