# CVEs published 2023-11-05

7 CVEs were published on November 5, 2023: 0 critical, 0 high. Days are UTC.

- [CVE-2018-25092](https://cve.now/CVE-2018-25092.md): Vaerys-Dawn DiscordSailv2 Command Mention access control (CVSS 5.5, Vaerys-Dawn DiscordSailv2)
- [CVE-2017-20187](https://cve.now/CVE-2017-20187.md): Magnesium-PHP Base.php formatEmailString injection (CVSS 3.5, Magnesium-PHP · floriangaerber/magnesium)
- [CVE-2023-47258](https://cve.now/CVE-2023-47258.md): Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter. (no CVSS)
- [CVE-2023-47259](https://cve.now/CVE-2023-47259.md): Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter. (no CVSS)
- [CVE-2023-47260](https://cve.now/CVE-2023-47260.md): Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails. (no CVSS)
- [CVE-2023-47271](https://cve.now/CVE-2023-47271.md): PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not ver (no CVSS)
- [CVE-2023-47272](https://cve.now/CVE-2023-47272.md): Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.