# CVEs published 2023-10-28

13 CVEs were published on October 28, 2023: 2 critical, 4 high. Days are UTC.

- [CVE-2023-5837](https://cve.now/CVE-2023-5837.md): AlexanderLivanov FotosCMS2 Cookie profile.php cross site scripting (CVSS 3.5, AlexanderLivanov FotosCMS2)
- [CVE-2023-5836](https://cve.now/CVE-2023-5836.md): SourceCodester Task Reminder System sql injection (CVSS 6.3, SourceCodester Task Reminder System)
- [CVE-2023-5835](https://cve.now/CVE-2023-5835.md): hu60t hu60wap6 ubbparser.php markdown cross site scripting (CVSS 3.5, hu60t hu60wap6)
- [CVE-2023-5425](https://cve.now/CVE-2023-5425.md): Post Meta Data Manager \<=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, gandhihitesh9 Post Meta Data Manager)
- [CVE-2023-5426](https://cve.now/CVE-2023-5426.md): Post Meta Data Manager \<=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion (CVSS 7.5, gandhihitesh9 Post Meta Data Manager)
- [CVE-2023-46215](https://cve.now/CVE-2023-46215.md): Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend (CVSS 7.5, Apache Software Foundation Apache Airflow Celery provide… +2)
- [CVE-2023-43322](https://cve.now/CVE-2023-43322.md): ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v (CVSS 8.8)
- [CVE-2023-45897](https://cve.now/CVE-2023-45897.md): exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read\_file\_dentry\_set. (no CVSS)
- [CVE-2023-46467](https://cve.now/CVE-2023-46467.md): Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload t (CVSS 5.4)
- [CVE-2023-46468](https://cve.now/CVE-2023-46468.md): An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function. (no CVSS, juzaweb/cms)
- [CVE-2023-46569](https://cve.now/CVE-2023-46569.md): An out-of-bounds read in radare2 v.5.8.9 and before exists in the print\_insn32\_fpu function of libr/arch/p/nds32/nds32-dis.h. (CVSS 9.8)
- [CVE-2023-46570](https://cve.now/CVE-2023-46570.md): An out-of-bounds read in radare2 v.5.8.9 and before exists in the print\_insn32 function of libr/arch/p/nds32/nds32-dis.h. (CVSS 9.8)
- [CVE-2023-46854](https://cve.now/CVE-2023-46854.md): Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.