CVEs published October 17, 2023
159 CVEs were published on October 17, 2023: 11 critical, 28 high.
- Published
- 159
- Critical
- 11
- High
- 28
- Medium
- 79
- Low
- 10
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Oracle MySQL Server
- 24
- IBM Security Verify Privilege
- 13
- SonicWall SonicOS
- 9
- Liferay DXP · Liferay Portal +2
- 7
- Oracle WebLogic Server
- 6
- Oracle Banking Trade Finance
- 5
- Oracle Database - Enterprise Edition
- 5
- EasyUse Digital Technology MailHunter Ultimate
- 4
- Oracle FLEXCUBE Universal Banking
- 3
- Oracle Java SE JDK and JRE
- 3
Critical 11
- CVE-2023-22089Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2023-22072Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2023-22069Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2023-42627Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP Liferay DXP · Liferay Portal +2
- CVE-2023-42628Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83Liferay DXP · Liferay Portal +2
- CVE-2023-44311Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class iLiferay DXP · Liferay Portal +2
- CVE-2023-44310Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 throLiferay DXP · Liferay Portal +2
- CVE-2023-44309Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay Liferay DXP · Liferay Portal +2
- CVE-2023-42629Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 Liferay DXP · Liferay Portal +2
- CVE-2023-42497Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and LiferaLiferay DXP · Liferay Portal +2
- CVE-2023-34207Unrestricted Upload of File with Dangerous Type in EasyUse MailHunter UltimateEasyUse Digital Technology MailHunter Ultimate
High 28
- CVE-2023-5552A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in SophSophos Firewall
- CVE-2023-45811Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscatorrelative synchrony · deobfuscator
- CVE-2023-41715SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privilegSonicWall SonicOS
- CVE-2023-22108Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2023-22102Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).Oracle MySQL Connectors · com.mysql:mysql-connector-j +1
- CVE-2023-22101Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2023-22100Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2023-22099Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2023-22098Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2023-22094Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General).Oracle MySQL Installer
- CVE-2023-22087Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera).Oracle Hospitality OPERA 5 Property Services
- CVE-2023-22086Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2023-22085Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera).Oracle Hospitality OPERA 5 Property Services
- CVE-2023-22019Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).Oracle HTTP Server
- CVE-2023-37537HCL AppScan Presence deployed as Windows service might be vulnerable to an Unquoted Service Path vulnerabilityHCL Software HCL AppScan Presence
- CVE-2023-20598 An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gainAMD Radeon™ RX 5000 Series Graphics Cards · AMD Radeon™… +10
- CVE-2023-45007WordPress Fotomoto Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)Fotomoto
- CVE-2023-45006WordPress WooODT Lite Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)ByConsole WooODT Lite – WooCommerce Order Delivery or Picku…
- CVE-2023-45004WordPress Woo Custom Emails Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)wp3sixty Woo Custom Emails
- CVE-2023-45003WordPress Social Feed Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)Arrow Plugins Social Feed | Custom Feed for Social Media Ne…
- CVE-2023-45005WordPress Seriously Simple Stats Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)Castos Seriously Simple Stats
- CVE-2023-39456Apache Traffic Server: Malformed http/2 frames can cause an abortApache Software Foundation Apache Traffic Server
- CVE-2023-41752Apache Traffic Server: s3_auth plugin problem with hash calculationApache Software Foundation Apache Traffic Server
- CVE-2023-34210SQL Injection in EasyUse MailHunter UltimateEasyUse Digital Technology MailHunter Ultimate
- CVE-2022-22375IBM Security Verify Privilege command executionIBM Security Verify Privilege
- CVE-2023-36321Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c
- CVE-2023-39902A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family proces
- CVE-2023-45358Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability.
Medium, low and unrated 120
- CVE-2023-5626Cross-Site Request Forgery (CSRF) in pkp/ojspkp/ojs
- CVE-2023-3042CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8dotCMS core
- CVE-2023-42507Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier.JTEKT ELECTRONICS OnSinView2
- CVE-2023-42506Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier.JTEKT ELECTRONICS OnSinView2
- CVE-2023-45810OpenFGA denial of serviceopenfga · github.com/openfga/openfga
- CVE-2023-41713SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.SonicWall SonicOS
- CVE-2023-41712SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.SonicWall SonicOS
- CVE-2023-41711SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crashSonicWall SonicOS
- CVE-2023-39280SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firewSonicWall SonicOS
- CVE-2023-39279SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crashSonicWall SonicOS
- CVE-2023-39278SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crashSonicWall SonicOS
- CVE-2023-39277 SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to aSonicWall SonicOS
- CVE-2023-39276 SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash.SonicWall SonicOS
- CVE-2023-22130Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core).Oracle Sun ZFS Storage Appliance Kit (AK) Software
- CVE-2023-22129Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris Operating System
- CVE-2023-22128Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem).Oracle Solaris Operating System
- CVE-2023-22127Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF Oracle Outside In Technology
- CVE-2023-22126Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).Oracle WebCenter Content
- CVE-2023-22125Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2023-22124Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2023-22123Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2023-22122Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2023-22121Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2023-22119Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2023-22118Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2023-22117Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2023-22115Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Oracle MySQL Server
- CVE-2023-22114Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2023-22113Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).Oracle MySQL Server
- CVE-2023-22112Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22111Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF).Oracle MySQL Server
- CVE-2023-22110Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22109Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Dashboards).Oracle Business Intelligence Enterprise Edition
- CVE-2023-22107Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: UI Components).Oracle Enterprise Command Center Framework
- CVE-2023-22106Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API).Oracle Enterprise Command Center Framework
- CVE-2023-22105Vulnerability in the BI Publisher product of Oracle Analytics (component: Web Server).Oracle BI Publisher
- CVE-2023-22104Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2023-22103Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22097Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2023-22096Vulnerability in the Java VM component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2023-22095Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22093Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Requisition and Vacancy).Oracle iRecruitment
- CVE-2023-22092Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22091Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler).Oracle GraalVM Enterprise Edition
- CVE-2023-22090Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Events & Notifications).Oracle PeopleSoft Enterprise CC Common Application Objects
- CVE-2023-22088Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: User ManagOracle Communications Order and Service Management
- CVE-2023-22084Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2023-22083Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Web UI).Oracle Enterprise Communications Broker · Oracle Enterprise…
- CVE-2023-22082Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin).Oracle Business Intelligence Enterprise Edition
- CVE-2023-22081Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).Oracle Java SE JDK and JRE
- CVE-2023-22080Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2023-22079Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22078Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22077Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2023-22076Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).Oracle Applications Framework
- CVE-2023-22075Vulnerability in the Oracle Database Sharding component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2023-22074Vulnerability in the Oracle Database Sharding component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2023-22073Vulnerability in the Oracle Notification Server component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2023-22071Vulnerability in the PL/SQL component of Oracle Database Server.Oracle PL/SQL
- CVE-2023-22070Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22068Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2023-22067Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA).Oracle Java SE JDK and JRE
- CVE-2023-22066Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2023-22065Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22064Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22059Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22032Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22029Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Workbench).Commerce Guided Search / Oracle Commerce Experience Manager
- CVE-2023-22028Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22026Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-22025Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: HotspoOracle Java SE JDK and JRE
- CVE-2023-22015Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2023-43794SQL Injection in nocodbnocodb
- CVE-2023-45803Request body not stripped after redirect in urllib3urllib3
- CVE-2023-4896Authenticated Disclosure of Sensitive Information in AirWave Management PlatformHewarHewlett Packard Enterprise (HPE) Aruba AirWave Managem…
- CVE-2023-43777Insecure storage of password in easySoftEaton easySoft
- CVE-2023-43776Weak encoding vulnerability in easyE4Eaton easyE4
- CVE-2022-3761OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intOpenVPN Connect
- CVE-2023-45010WordPress Complete Open Graph Plugin <= 3.4.5 is vulnerable to Cross Site Scripting (XSS)Alex MacArthur Complete Open Graph
- CVE-2023-5522Mobile app freezes when receiving a post with hundreds of emojisMattermost
- CVE-2023-5339Mattermost Desktop logs all keystrokes during initial run after fresh installation Mattermost
- CVE-2023-44990WordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Scripting (XSS)realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…
- CVE-2023-24385WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)David Lingren Media Library Assistant
- CVE-2023-4399Grafana is an open-source platform for monitoring and observability.Grafana Enterprise
- CVE-2023-4089WAGO: Multiple products vulnerable to local file inclusionWAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2023-34209Exposure of Sensitive System Information to an Unauthorized Control Sphere in EasyUse MailHunter UltimateEasyUse Digital Technology MailHunter Ultimate
- CVE-2023-34208Path Traversal in EasyUse MailHunter UltimateEasyUse Digital Technology MailHunter Ultimate
- CVE-2022-43891IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2022-43892IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2022-43893IBM Security Verify Privilege denial of serviceIBM Security Verify Privilege
- CVE-2022-43889IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2021-29913IBM Security Verify Privilege improper input validationIBM Security Verify Privilege
- CVE-2022-22380IBM Security Verify Privilege improper authenticationIBM Security Verify Privilege
- CVE-2021-20581IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2021-38859IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2022-22385IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2022-22386IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2022-22384IBM Security Verify Privilege improper input validationIBM Security Verify Privilege
- CVE-2022-22377IBM Security Verify Privilege information disclosureIBM Security Verify Privilege
- CVE-2023-27132TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web por
- CVE-2023-27133TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www
- CVE-2023-41629A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal.
- CVE-2023-41630eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component.
- CVE-2023-41631eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function.
- CVE-2023-43959An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping fun
- CVE-2023-44693D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.
- CVE-2023-44694D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php.
- CVE-2023-44824An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php
- CVE-2023-45357Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability.
- CVE-2023-45375In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `Pire
- CVE-2023-45386In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::search
- CVE-2023-45901Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin\/category\/add.
- CVE-2023-45902Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete.
- CVE-2023-45903Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete.
- CVE-2023-45904Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.
- CVE-2023-45905Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.
- CVE-2023-45906Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.
- CVE-2023-45907Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.
- CVE-2023-45951lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.
- CVE-2023-45952An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via u