# CVEs published 2023-10-20

125 CVEs were published on October 20, 2023: 7 critical, 29 high. Days are UTC.

- [CVE-2023-45682](https://cve.now/CVE-2023-45682.md): Wild address read in vorbis\_decode\_packet\_rest in stb\_vorbis (CVSS 5.3, nothings stb)
- [CVE-2023-45681](https://cve.now/CVE-2023-45681.md): Out of bounds heap buffer write in stb\_vorbis (CVSS 7.3, nothings stb)
- [CVE-2023-45680](https://cve.now/CVE-2023-45680.md): Null pointer dereference in vorbis\_deinit in stb\_vorbis (CVSS 5.3, nothings stb)
- [CVE-2023-45679](https://cve.now/CVE-2023-45679.md): Attempt to free an uninitialized memory pointer in vorbis\_deinit in stb\_vorbis (CVSS 7.3, nothings stb)
- [CVE-2023-45678](https://cve.now/CVE-2023-45678.md): Off-by-one heap buffer write in start\_decoder in stb\_vorbis (CVSS 6.5, nothings stb)
- [CVE-2023-45677](https://cve.now/CVE-2023-45677.md): Heap buffer out of bounds write in start\_decoder in stb\_vorbis (CVSS 7.3, nothings stb)
- [CVE-2023-45676](https://cve.now/CVE-2023-45676.md): Multi-byte write heap buffer overflow in start\_decoder in stb\_vorbis (CVSS 7.3, nothings stb)
- [CVE-2023-45675](https://cve.now/CVE-2023-45675.md): 0 byte write heap buffer overflow in start\_decoder in stb\_vorbis (CVSS 6.5, nothings stb)
- [CVE-2023-45667](https://cve.now/CVE-2023-45667.md): Null pointer dereference because of an uninitialized variable in stb\_image (CVSS 5.3, nothings stb)
- [CVE-2023-45666](https://cve.now/CVE-2023-45666.md): Possible double-free or memory leak in stbi\_\_load\_gif\_main in stb\_image (CVSS 7.3, nothings stb)
- [CVE-2023-45664](https://cve.now/CVE-2023-45664.md): Double-free in stbi\_\_load\_gif\_main\_outofmem in stb\_image (CVSS 7.3, nothings stb)
- [CVE-2023-45663](https://cve.now/CVE-2023-45663.md): Disclosure of uninitialized memory in stbi\_\_tga\_load in stb\_image (CVSS 5.3, nothings stb)
- [CVE-2023-45662](https://cve.now/CVE-2023-45662.md): Multi-byte read heap buffer overflow in stbi\_\_vertical\_flip in stb\_image (CVSS 6.5, nothings stb)
- [CVE-2023-45661](https://cve.now/CVE-2023-45661.md): Wild address read in stbi\_\_gif\_load\_next in stb\_image (CVSS 6.5, nothings stb)
- [CVE-2023-5682](https://cve.now/CVE-2023-5682.md): Tongda OA delete.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-5681](https://cve.now/CVE-2023-5681.md): Netentsec NS-ASG Application Security Gateway list\_addr\_fwresource\_ip.php sql injection (CVSS 4.7, Netentsec NS-ASG Application Security Gateway)
- [CVE-2023-46117](https://cve.now/CVE-2023-46117.md): Inadequate validation of retrieved subdomains may lead to a Remote Code Execution in reconFTW (CVSS 9.6, six2dez reconftw)
- [CVE-2023-45805](https://cve.now/CVE-2023-45805.md): Trojan Lockfilein pdm (CVSS 7.8, pdm-project pdm · pdm)
- [CVE-2023-5690](https://cve.now/CVE-2023-5690.md): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (CVSS 5.3, modoboa/modoboa · modoboa)
- [CVE-2023-5689](https://cve.now/CVE-2023-5689.md): Cross-site Scripting (XSS) - DOM in modoboa/modoboa (CVSS 7.1, modoboa/modoboa · modoboa)
- [CVE-2023-5688](https://cve.now/CVE-2023-5688.md): Cross-site Scripting (XSS) - DOM in modoboa/modoboa (CVSS 9.8, modoboa/modoboa · modoboa)
- [CVE-2023-5687](https://cve.now/CVE-2023-5687.md): Cross-Site Request Forgery (CSRF) in mosparo/mosparo (CVSS 5.4, mosparo/mosparo)
- [CVE-2023-5686](https://cve.now/CVE-2023-5686.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 5.1, radareorg/radare2)
- [CVE-2023-23373](https://cve.now/CVE-2023-23373.md): QUSBCam2 (CVSS 8.8, QNAP Systems QUSBCam2)
- [CVE-2023-3933](https://cve.now/CVE-2023-3933.md): Your Journey \<= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting (CVSS 6.1, wiloke Your Journey)
- [CVE-2023-3962](https://cve.now/CVE-2023-3962.md): Winters \<= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting (CVSS 6.1, myshopkit Winters - WordPress Blog Theme)
- [CVE-2023-3965](https://cve.now/CVE-2023-3965.md): nsc \<= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting (CVSS 6.1, National Show Centre NSC WordPress Theme)
- [CVE-2023-3487](https://cve.now/CVE-2023-3487.md): Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory access (CVSS 7.7, silabs.com GSDK)
- [CVE-2023-5618](https://cve.now/CVE-2023-5618.md): Modern Footnotes \<= 1.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, prismtechstudios Modern Footnotes)
- [CVE-2023-44483](https://cve.now/CVE-2023-44483.md): Apache Santuario: Private Key disclosure in debug-log output (no CVSS, Apache Software Foundation Apache Santuario · org.apache.sa…)
- [CVE-2023-44256](https://cve.now/CVE-2023-44256.md): A server-side request forgery vulnerability \[CWE-918\] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 (CVSS 6.4, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2023-34045](https://cve.now/CVE-2023-34045.md): VMware Fusion installer local privilege escalation (CVSS 6.6, VMware Fusion)
- [CVE-2023-34046](https://cve.now/CVE-2023-34046.md): VMware Fusion TOCTOU local privilege escalation vulnerability (CVSS 6.7, VMware Fusion)
- [CVE-2023-34044](https://cve.now/CVE-2023-34044.md): Information disclosure vulnerability in bluetooth device-sharing functionality (CVSS 7.1, VMware Workstation · VMware Fusion)
- [CVE-2023-4648](https://cve.now/CVE-2023-4648.md): WP Customer Reviews \<= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, bompus WP Customer Reviews)
- [CVE-2022-3622](https://cve.now/CVE-2022-3622.md): Blog2Social \<= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.1, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2023-4021](https://cve.now/CVE-2023-4021.md): Modern Events Calendar lite \< 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, webnus/ Modern Events Calendar Lite)
- [CVE-2023-5109](https://cve.now/CVE-2023-5109.md): WP Mailto Links – Protect Email Addresses \<= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, onlineoptimisation WP Mailto Links – Protect Email Addresses)
- [CVE-2021-4334](https://cve.now/CVE-2021-4334.md): Fancy Product Designer \<= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd\_update\_options (CVSS 8.8, radykal Fancy Product Designer)
- [CVE-2023-5070](https://cve.now/CVE-2023-5070.md): Social Media Share Buttons & Social Sharing Icons \<= 2.8.5 - Information Exposure (CVSS 6.5, inisev Social Media Share Buttons & Social Sharing Icons)
- [CVE-2023-5086](https://cve.now/CVE-2023-5086.md): Copy Anything to Clipboard \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, clipboardagency Copy Anything to Clipboard for WordPress –…)
- [CVE-2020-36759](https://cve.now/CVE-2020-36759.md): Woody code snippets \<= 2.3.9 - Cross-Site Request Forgery Bypass (CVSS 4.3, themeisle Woody Code Snippets – Insert PHP, CSS, JS, and He…)
- [CVE-2020-36758](https://cve.now/CVE-2020-36758.md): RSS Aggregator by Feedzy \<= 3.4.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2023-5292](https://cve.now/CVE-2023-5292.md): Advanced Custom Fields: Extended \<= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, hwk-fr Advanced Custom Fields: Extended)
- [CVE-2020-36755](https://cve.now/CVE-2020-36755.md): Customizr \<= 4.3.0 - Cross-Site Request Forgery Bypass (CVSS 4.3, nikeo Customizr)
- [CVE-2020-36754](https://cve.now/CVE-2020-36754.md): Paid Memberships Pro \<= 2.4.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, strangerstudios Paid Memberships Pro – Content Restriction,…)
- [CVE-2020-36753](https://cve.now/CVE-2020-36753.md): Hueman \<= 3.6.3 - Cross-Site Request Forgery Bypass (CVSS 4.3, nikeo Hueman)
- [CVE-2023-5602](https://cve.now/CVE-2023-5602.md): Social Media Share Buttons & Social Sharing Icons \<= 2.8.5 - Cross-Site Request Forgery (CVSS 4.3, inisev Social Media Share Buttons & Social Sharing Icons)
- [CVE-2021-4418](https://cve.now/CVE-2021-4418.md): Custom CSS, JS & PHP \<= 2.0.7 - Cross-Site Request Forgery Bypass (CVSS 4.3, flippercode Custom css-js-php)
- [CVE-2023-5231](https://cve.now/CVE-2023-5231.md): Magic Action Box \<= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, pogidude Magic Action Box)
- [CVE-2023-4668](https://cve.now/CVE-2023-4668.md): Ad Inserter \<= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe (CVSS 5.3, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2023-5121](https://cve.now/CVE-2023-5121.md): Migration, Backup, Staging – WPvivid \<= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2022-4290](https://cve.now/CVE-2022-4290.md): Cyr to Lat \<= 3.5 - Authenticated SQL Injection (CVSS 8.8, ivijanstefan Cyr to Lat Enhanced)
- [CVE-2023-3996](https://cve.now/CVE-2023-3996.md): ARMember Lite - Membership Plugin \<= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2023-4999](https://cve.now/CVE-2023-4999.md): Horizontal scrolling announcement \<= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode (CVSS 8.8, gopiplus Horizontal scrolling announcement)
- [CVE-2023-4941](https://cve.now/CVE-2023-4941.md): BEAR \<= 1.1.3.3 - Missing Authorization to Product Manipulation (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-3869](https://cve.now/CVE-2023-3869.md): wpDiscuz \<= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease (CVSS 5.3, advancedcoding Comments – wpDiscuz)
- [CVE-2022-2441](https://cve.now/CVE-2022-2441.md): ImageMagick Engine \<= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution (CVSS 8.8, rickardw ImageMagick Engine)
- [CVE-2023-4386](https://cve.now/CVE-2023-4386.md): Essential Blocks \<= 4.2.0 - Unauthenticated PHP Object Injection via queries (CVSS 8.1, wpdevteam Essential Blocks Pro · wpdevteam Gutenberg Essent…)
- [CVE-2023-5337](https://cve.now/CVE-2023-5337.md): Contact form Form For All \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, formforall Contact form Form For All – Easy to use, fast, 3…)
- [CVE-2023-4926](https://cve.now/CVE-2023-4926.md): BEAR \<= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion (CVSS 5.4, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2020-36751](https://cve.now/CVE-2020-36751.md): Coupon Creator \<= 3.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, brianjessee Coupon Creator)
- [CVE-2023-5533](https://cve.now/CVE-2023-5533.md): AI ChatBot \<= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions (CVSS 5.3, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2023-4796](https://cve.now/CVE-2023-4796.md): Booster for WooCommerce \<= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode (CVSS 4.3, pluggabl Booster for WooCommerce – PDF Invoices, Abandoned…)
- [CVE-2023-3998](https://cve.now/CVE-2023-3998.md): wpDiscuz \<= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease (CVSS 5.3, advancedcoding Comments – wpDiscuz)
- [CVE-2022-3342](https://cve.now/CVE-2022-3342.md): Jetpack CRM \<= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization (CVSS 7.5, automattic Jetpack CRM – Clients, Leads, Invoices, Billing,…)
- [CVE-2020-36714](https://cve.now/CVE-2020-36714.md): Brizy \< 1.0.126 - Authorization Bypass to Settings Updates (CVSS 7.4, themefusecom Brizy – Page Builder)
- [CVE-2023-5615](https://cve.now/CVE-2023-5615.md): Skype Legacy Buttons \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ravanh Skype Legacy Buttons)
- [CVE-2023-5534](https://cve.now/CVE-2023-5534.md): AI ChatBot \<= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions (CVSS 4.3, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2023-4924](https://cve.now/CVE-2023-4924.md): BEAR \<= 1.1.3.3 - Missing Authorization to Product Deletion (CVSS 5.4, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-4923](https://cve.now/CVE-2023-4923.md): BEAR \<= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion (CVSS 5.4, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-4961](https://cve.now/CVE-2023-4961.md): Poptin \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Poptin – Exit Pop Ups & Email Popups)
- [CVE-2022-4943](https://cve.now/CVE-2022-4943.md): miniOrange's Google Authenticator \<= 5.6.5 - Missing Authorization to Plugin Settings Change (CVSS 7.5, cyberlord92 miniOrange 2FA – Two-Factor Authentication for…)
- [CVE-2023-5524](https://cve.now/CVE-2023-5524.md): M-Files Web Companion allows Remote Code Execution for some filetypes (CVSS 8.2, M-Files Web Companion)
- [CVE-2023-5523](https://cve.now/CVE-2023-5523.md): M-Files Web Companion allows Remote Code Execution (CVSS 8.6, M-Files Web Companion)
- [CVE-2023-2325](https://cve.now/CVE-2023-2325.md): Stored XSS Vulnerability in M-Files Classic Web (CVSS 7.3, M-Files Web)
- [CVE-2022-4712](https://cve.now/CVE-2022-4712.md): WP Cerber Security \<= 9.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, gioni WP Cerber Security, Anti-spam & Malware Scan)
- [CVE-2023-4968](https://cve.now/CVE-2023-4968.md): WPLegalPages \<= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode (CVSS 5.5, wplegalpages Privacy Policy Generator – WPLP Legal Pages)
- [CVE-2023-4488](https://cve.now/CVE-2023-4488.md): Dropbox Folder Share \<= 1.9.7 - Unauthenticated Local File Inclusion (CVSS 9.8, hyno Dropbox Folder Share)
- [CVE-2021-4335](https://cve.now/CVE-2021-4335.md): Fancy Product Designer \<= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions (CVSS 6.3, radykal Fancy Product Designer)
- [CVE-2023-4935](https://cve.now/CVE-2023-4935.md): BEAR \<= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-4274](https://cve.now/CVE-2023-4274.md): The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. (CVSS 8.7, wpvividplugins Migration, Backup, Staging – WPvivid)
- [CVE-2021-4353](https://cve.now/CVE-2021-4353.md): WooCommerce Dynamic Pricing and Discounts \<= 2.4.1 - Unauthenticated Settings Import/Export (CVSS 5.3, RightPress WooCommerce Dynamic Pricing and Discounts)
- [CVE-2023-4920](https://cve.now/CVE-2023-4920.md): BEAR \<= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2020-36706](https://cve.now/CVE-2020-36706.md): Simple:Press – WordPress Forum Plugin \<= 6.6.0 - Arbitrary File Upload (CVSS 9.8, simplepress Simple:Press Forum)
- [CVE-2023-5576](https://cve.now/CVE-2023-5576.md): Migration, Backup, Staging – WPvivid \<= 0.9.91 - Google Drive Client Secret Exposure (CVSS 8.0, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2023-5414](https://cve.now/CVE-2023-5414.md): Icegram Express \<= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read (CVSS 9.1, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2023-4937](https://cve.now/CVE-2023-4937.md): BEAR \<= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-4271](https://cve.now/CVE-2023-4271.md): Photospace Responsive \<= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, deanoakley Photospace Responsive Gallery)
- [CVE-2023-4919](https://cve.now/CVE-2023-4919.md): iframe \<= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode (CVSS 6.4, webvitaly iframe)
- [CVE-2023-5120](https://cve.now/CVE-2023-5120.md): Migration, Backup, Staging – WPvivid \<= 0.9.89 - Authenticated Stored Cross-Site Scripting (CVSS 4.4, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2023-5200](https://cve.now/CVE-2023-5200.md): flowpaper \<= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, getflowpaper flowpaper)
- [CVE-2023-4940](https://cve.now/CVE-2023-4940.md): BEAR \<= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-5050](https://cve.now/CVE-2023-5050.md): Leaflet Map \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, bozdoz Leaflet Map)
- [CVE-2022-4954](https://cve.now/CVE-2022-4954.md): Waiting: One-click countdowns \<= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting (CVSS 5.5, pluginbuilders Waiting: One-click countdowns)
- [CVE-2023-4943](https://cve.now/CVE-2023-4943.md): BEAR \<= 1.1.3.3 - Missing Authorization to Product Manipulation (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-4975](https://cve.now/CVE-2023-4975.md): Website Builder by SeedProd \<= 6.15.13.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, Website Builder by SeedProd — Theme Builder, Landing Page B…)
- [CVE-2023-4947](https://cve.now/CVE-2023-4947.md): WooCommerce EAN Payment Gateway \< 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update (CVSS 4.3, Yan&Co WooCommerce EAN Payment Gateway)
- [CVE-2023-4942](https://cve.now/CVE-2023-4942.md): BEAR \<= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation (CVSS 4.3, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2023-4402](https://cve.now/CVE-2023-4402.md): Essential Blocks \<= 4.2.0 - Unauthenticated PHP Object Injection via products (CVSS 8.1, wpdevteam Essential Blocks Pro · wpdevteam Gutenberg Essent…)
- [CVE-2023-5308](https://cve.now/CVE-2023-5308.md): Podcast Subscribe Buttons \<= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, secondlinethemes Podcast Subscribe Buttons)
- [CVE-2023-4482](https://cve.now/CVE-2023-4482.md): Auto Amazon Links \<= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via style (CVSS 6.4, miunosoft Auto Amazon Links – Amazon Associates Affiliate P…)
- [CVE-2020-36698](https://cve.now/CVE-2020-36698.md): Security & Malware scan by CleanTalk \<= 2.50 - Missing Authorization (CVSS 8.8, Login Security, FireWall, Malware removal by CleanTalk)
- [CVE-2023-4598](https://cve.now/CVE-2023-4598.md): Slimstat Analytics \<= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode (CVSS 8.8, veronalabs SlimStat Analytics)
- [CVE-2023-5071](https://cve.now/CVE-2023-5071.md): Sitekit \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit\_iframe' shortcode (CVSS 6.4, webvitaly Sitekit)
- [CVE-2023-5668](https://cve.now/CVE-2023-5668.md): WhatsApp Share Button \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, alexmoss WhatsApp Share Button)
- [CVE-2023-5613](https://cve.now/CVE-2023-5613.md): Super Testimonials \<= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, themepoints Super Testimonial – Testimonial & Customer Revi…)
- [CVE-2023-5614](https://cve.now/CVE-2023-5614.md): Theme Switcha \<= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, specialk Theme Switcha – Easily Switch Themes for Developme…)
- [CVE-2023-34051](https://cve.now/CVE-2023-34051.md): VMware Aria Operations for Logs contains an authentication bypass vulnerability. (CVSS 9.8, VMware Aria Operations for Logs)
- [CVE-2023-34052](https://cve.now/CVE-2023-34052.md): VMware Aria Operations for Logs contains a deserialization vulnerability. (no CVSS, VMware Aria Operations for Logs)
- [CVE-2023-32786](https://cve.now/CVE-2023-32786.md): In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially p (no CVSS, langchain)
- [CVE-2023-37824](https://cve.now/CVE-2023-37824.md): Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate\_hook (CVSS 9.8)
- [CVE-2023-38191](https://cve.now/CVE-2023-38191.md): An issue was discovered in SuperWebMailer 9.00.0.01710. (no CVSS)
- [CVE-2023-39680](https://cve.now/CVE-2023-39680.md): Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code. (CVSS 7.5)
- [CVE-2023-40361](https://cve.now/CVE-2023-40361.md): SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. (no CVSS)
- [CVE-2023-43346](https://cve.now/CVE-2023-43346.md): Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scr (no CVSS)
- [CVE-2023-43353](https://cve.now/CVE-2023-43353.md): Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the e (no CVSS)
- [CVE-2023-43354](https://cve.now/CVE-2023-43354.md): Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the P (no CVSS)
- [CVE-2023-43355](https://cve.now/CVE-2023-43355.md): Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the p (no CVSS)
- [CVE-2023-43356](https://cve.now/CVE-2023-43356.md): Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the G (no CVSS)
- [CVE-2023-43357](https://cve.now/CVE-2023-43357.md): Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T (no CVSS)
- [CVE-2023-45394](https://cve.now/CVE-2023-45394.md): Stored Cross-Site Scripting (XSS) vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker t (no CVSS)
- [CVE-2023-45471](https://cve.now/CVE-2023-45471.md): The QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and including, 1.0.0.315 due to insufficient che (no CVSS)
- [CVE-2023-46277](https://cve.now/CVE-2023-46277.md): please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (no CVSS, pleaser)
- [CVE-2023-46287](https://cve.now/CVE-2023-46287.md): XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.