# CVEs published 2023-09-16

9 CVEs were published on September 16, 2023: 1 critical, 1 high. Days are UTC.

- [CVE-2023-5013](https://cve.now/CVE-2023-5013.md): Pluck CMS Installation install.php cross site scripting (CVSS 2.6, Pluck CMS)
- [CVE-2023-5012](https://cve.now/CVE-2023-5012.md): Topaz OFD Protection Module Warsaw core.exe unquoted search path (CVSS 5.3, Topaz OFD)
- [CVE-2023-3025](https://cve.now/CVE-2023-3025.md): Dropbox Folder Share \<= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link' (CVSS 7.2, hyno Dropbox Folder Share)
- [CVE-2023-5001](https://cve.now/CVE-2023-5001.md): Horizontal scrolling announcement \<= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, gopiplus Horizontal scrolling announcement)
- [CVE-2023-4994](https://cve.now/CVE-2023-4994.md): Allow PHP in Posts and Pages \<= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode (CVSS 9.9, hit-reach Allow PHP in Posts and Pages)
- [CVE-2023-39612](https://cve.now/CVE-2023-39612.md): A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administ (no CVSS)
- [CVE-2023-39777](https://cve.now/CVE-2023-39777.md): A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2023-41157](https://cve.now/CVE-2023-41157.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2023-42336](https://cve.now/CVE-2023-42336.md): An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.