CVEs published November 30, 2023
205 CVEs were published on November 30, 2023: 19 critical, 37 high. 2 are now in CISA KEV.
- Published
- 205
- Critical
- 19
- High
- 37
- Medium
- 110
- Low
- 5
- Unrated
- 34
- Now in CISA KEV
- 2
- Fix available
- 28
Most affected products
- Voovi Social Networking Script
- 11
- BigProf Online Inventory Manager
- 6
- Zyxel NAS326 firmware · Zyxel NAS542 firmware
- 6
- Schweitzer Engineering Laboratories SEL-451
- 5
- BigProf Online Clinic Management System
- 4
- BigProf Online Invoicing System
- 4
- Delta Electronics InfraSuite Device Master
- 4
- Schweitzer Engineering Laboratories SEL-411L
- 4
- Tyler Technologies Court Case Management Plus
- 4
- ASR Falcon
- 3
Critical 19
- CVE-2023-47207Delta Electronics InfraSuite Device Master Deserialization of Untrusted DataDelta Electronics InfraSuite Device Master
- CVE-2023-39226Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or FunctionDelta Electronics InfraSuite Device Master
- CVE-2023-5908Heap Based Buffer Overflow in PTC KEPServerExPTC KEPServerEX · PTC ThingWorx Kepware Server +6
- CVE-2023-6026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in PHPMemcachedAdminPHPMemcachedAdmin · elijaa/phpmemcacheadmin
- CVE-2023-6418SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6417SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6416SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6415SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6414SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6413SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6412SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6411SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6410SQL injection in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2022-45135Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorActionApache Software Foundation Apache Cocoon · org.apache.cocoo…
- CVE-2023-4474The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmwareZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-4473A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(Zyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-35138A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-47463Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a cra
- CVE-2023-48802In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
High 37
- CVE-2023-42917A memory corruption vulnerability was addressed with improved locking.Apple Safari · Apple macOS +1
- CVE-2023-47279Delta Electronics InfraSuite Device Master Path TraversalDelta Electronics InfraSuite Device Master
- CVE-2023-46690Delta Electronics InfraSuite Device Master Path TraversalDelta Electronics InfraSuite Device Master
- CVE-2023-5909Improper Validation of Certificate with Host Mismatch in PTC KEPServerExPTC KEPServerEX · PTC ThingWorx Kepware Server +6
- CVE-2023-47870WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)gVectors Team wpForo Forum
- CVE-2023-47521WordPress Q2W3 Post Order Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)Max Bond, AndreSC Q2W3 Post Order
- CVE-2023-38400WordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)Kriesi Enfold - Responsive Multi-Purpose Theme
- CVE-2023-47844WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)Lim Kai Yang Grab & Save
- CVE-2023-31176Insufficient entropy vulnerability could lead to authentication bypassSchweitzer Engineering Laboratories SEL-451
- CVE-2023-47848WordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS)Tainacan.org Tainacan
- CVE-2023-47876WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)Perfmatters
- CVE-2023-48272WordPress Maspik – Spam blacklist Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)yonifre Maspik – Spam Blacklist
- CVE-2023-48746WordPress Community by PeepSo Plugin <= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS)Community by PeepSo – Social Network, Membership, Registrat…
- CVE-2023-48748WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)Theme nectar Salient Core
- CVE-2023-48752WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS)Form builder to get in touch with visitors, grow your email…
- CVE-2023-48278WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to XSSNitin Rathod WP Forms Puzzle Captcha
- CVE-2023-46086WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)SERVIT Software Solutions affiliate-toolkit – WordPress Aff…
- CVE-2023-6360The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' pamy-calendar
- CVE-2023-40211WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data ExposurePickPlugins Post Grid Combo – 36+ Gutenberg Blocks
- CVE-2023-44150WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data ExposureProfilePress Membership Team Paid Membership Plugin, Ecomme…
- CVE-2023-48742WordPress License Manager for WooCommerce Plugin <= 2.2.10 is vulnerable to SQL InjectionLicenseManager License Manager for WooCommerce
- CVE-2023-33333WordPress Complianz and Complianz Premium plugins - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)Really Simple Plugins Complianz
- CVE-2023-36682WordPress Schema Pro Plugin <= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF)Brainstorm Force US Schema Pro
- CVE-2023-6071 An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administratorTrellix ESM
- CVE-2023-38474WordPress Campaign Monitor for WordPress Plugin <= 2.8.12 is vulnerable to Cross Site Scripting (XSS)Campaign Monitor for WordPress
- CVE-2023-48322WordPress eDoc Employee Job Application Plugin <= 1.13 is vulnerable to Cross Site Scripting (XSS)eDoc Intelligence eDoc Employee Job Application – Best Word…
- CVE-2023-48326WordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)Pixelite Events Manager
- CVE-2023-49701Out-of-bounds access a buffer in SIM managementASR Falcon
- CVE-2023-49077mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulationmailcow-dockerized
- CVE-2023-49095nexkey allows arbitrary users to impersonate any remote user due to missing signature validationnexryai nexkey
- CVE-2023-49081aiohttp's ClientSession is vulnerable to CRLF injection via versionaio-libs aiohttp · aiohttp
- CVE-2023-49097ZITADEL vulnerable account takeover via malicious host header injectionzitadel · github.com/zitadel/zitadel
- CVE-2023-5247Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Mitsubishi Electric GX Works3 · Mitsubishi Electric MELS… +2
- CVE-2023-37928A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 fiZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-37927The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmwareZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-35137An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmwZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-46956SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted pay
Medium, low and unrated 149
- CVE-2023-42916An out-of-bounds read was addressed with improved input validation.Apple Safari · Apple macOS +1
- CVE-2023-49735Apache Tiles: Unvalidated input may lead to path traversal and XXEApache Software Foundation Apache Tiles · org.apache.til… +2
- CVE-2023-6442PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php cross site scriptingPHPGurukul Nipah Virus Testing Management System
- CVE-2023-6440SourceCodester Book Borrower System add-book.php cross site scriptingSourceCodester Book Borrower System
- CVE-2023-6439ZenTao PMS cross site scriptingZenTao PMS
- CVE-2023-6352Aquaforest TIFF Server default configuration allows access to arbitrary filesAquaforest TIFF Server
- CVE-2023-6376Henschen & Associates court document management software cache uses predictable file namesHenschen & Associates court document management software
- CVE-2023-6375Tyler Technologies Magistrate Court Case Management Plus stores backups insecurelyTyler Technologies Court Case Management Plus
- CVE-2023-6354Tyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypassTyler Technologies Magistrate Court Case Management Plus
- CVE-2023-6353Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypassTyler Technologies Civil and Criminal Electronic Filing
- CVE-2023-6344Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server te003.aspx and te004.aspx allows authentication bypassTyler Technologies Court Case Management Plus
- CVE-2023-6343Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server tssp.aspx allows authentication bypassTyler Technologies Court Case Management Plus
- CVE-2023-6341Catalis CM360 allows authentication bypass Catalis CMS360
- CVE-2023-6342Tyler Technologies Court Case Management Plus "pay for print" allows authentication bypassTyler Technologies Court Case Management Plus
- CVE-2023-34018WordPress SoundCloud Shortcode Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)SoundCloud Shortcode
- CVE-2023-6438Thecosy IceCMS Like improper enforcement of a single, unique actionThecosy IceCMS
- CVE-2023-2267Improper input validation could lead to reflection injection attacksSchweitzer Engineering Laboratories SEL-411L
- CVE-2023-2266Improper neutralization of input during web page generation could lead to cross-site scripting based attacksSchweitzer Engineering Laboratories SEL-411L
- CVE-2023-2265Improper restriction of rendered UI layers or frames could lead to clickjacking attackSchweitzer Engineering Laboratories SEL-411L
- CVE-2023-2264Improper input validition could lead to code injectionSchweitzer Engineering Laboratories SEL-411L
- CVE-2023-34390 Improper input validation could lead to denial of serviceSchweitzer Engineering Laboratories SEL-451
- CVE-2023-34389Allocation of resources without limits could lead to denial of serviceSchweitzer Engineering Laboratories SEL-451
- CVE-2023-34388Improper authentication could lead to session hijackingSchweitzer Engineering Laboratories SEL-451
- CVE-2023-31177Improper neutralizataion of input could lead to execution of arbitrary codeSchweitzer Engineering Laboratories SEL-451
- CVE-2023-47853WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)myCred – Points, Rewards, Gamification, Ranks, Badges & Loy…
- CVE-2023-47872WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)gVectors Team wpForo Forum
- CVE-2023-47877WordPress Perfmatters Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS)Perfmatters
- CVE-2023-48317WordPress Display Custom Post Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)Vikas Vatsa Display Custom Post
- CVE-2023-48320WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)WebDorado SpiderVPlayer
- CVE-2023-48321WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobi…
- CVE-2023-48749WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)Theme nectar Salient Core
- CVE-2023-47875WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)Perfmatters
- CVE-2023-48328WordPress NextGEN Gallery Plugin <= 3.37 is vulnerable to Cross Site Request Forgery (CSRF)Imagely WordPress Gallery Plugin – NextGEN Gallery
- CVE-2023-48754WordPress Delete Post Revisions In WordPress Plugin <= 4.6 is vulnerable to Cross Site Request Forgery (CSRF)Wap Nepal Delete Post Revisions In WordPress
- CVE-2023-5803WordPress Business Directory Plugin Plugin <= 6.3.10 is vulnerable to Cross Site Request Forgery (CSRF)Business Directory Team Business Directory Plugin – Easy Li…
- CVE-2023-44143WordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)Bamboo Mcr Bamboo Columns
- CVE-2023-45609WordPress Powr Pack Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)POWR.io Contact Form – Custom Builder, Payment Form, and Mo…
- CVE-2023-39921WordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS)Author Box, Guest Author and Co-Authors for Your Posts – Mo…
- CVE-2023-25057WordPress Libsyn Publisher Hub Plugin <= 1.3.2 is vulnerable to Sensitive Data ExposureLibsyn Publisher Hub
- CVE-2023-26533WordPress Zippy Plugin <= 1.6.1 is vulnerable to Sensitive Data ExposureGesundheit Bewegt Zippy
- CVE-2023-36507WordPress BookingPress Plugin <= 1.0.64 is vulnerable to Sensitive Data ExposureRepute Infosystems BookingPress – Appointment Booking Calen…
- CVE-2023-36523WordPress Email download link Plugin <= 3.7 is vulnerable to Sensitive Data ExposureGopi Ramasamy Email download link
- CVE-2023-37868WordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data ExposureLeap13 Premium Addons PRO
- CVE-2023-37890WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access ControlWPOmnia KB Support – WordPress Help Desk and Knowledge Base
- CVE-2023-37972WordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data ExposureMultiVendorX Product Stock Manager & Notifier for WooCommer…
- CVE-2023-40600WordPress EWWW Image Optimizer Plugin <= 7.2.0 is vulnerable to Sensitive Data ExposureExactly WWW EWWW Image Optimizer
- CVE-2023-6402PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2023-40662WordPress Cookies and Content Security Policy Plugin <= 2.15 is vulnerable to Sensitive Data ExposureJonk @ Follow me Darling Cookies and Content Security Policy
- CVE-2023-41735WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Sensitive Data ExposureGopi Ramasamy Email posts to subscribers
- CVE-2023-45066WordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data ExposureSmackcoders Export All Posts, Products, Orders, Refunds & U…
- CVE-2023-45834WordPress Libsyn Publisher Hub Plugin <= 1.4.4 is vulnerable to Sensitive Data ExposureLibsyn Publisher Hub
- CVE-2023-46820WordPress Image Regenerate & Select Crop Plugin <= 7.3.0 is vulnerable to Sensitive Data ExposureIulia Cazan Image Regenerate & Select Crop
- CVE-2023-6401NotePad++ dbghelp.exe uncontrolled search pathNotePad++
- CVE-2023-48333WordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data ExposurePluggabl Booster for WooCommerce
- CVE-2023-6136WordPress Debug Log Manager Plugin <= 2.3.0 is vulnerable to Sensitive Data ExposureBowo Debug Log Manager
- CVE-2023-37867WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race ConditionYetAnotherStarsRating.com YASR – Yet Another Star Rating Pl…
- CVE-2023-6435Cross-site Scripting vulnerability in BigProf productsBigProf Online Inventory Manager
- CVE-2023-6434Cross-site Scripting vulnerability in BigProf productsBigProf Online Inventory Manager
- CVE-2023-6433Cross-site Scripting vulnerability in BigProf productsBigProf Online Inventory Manager
- CVE-2023-6432Cross-site Scripting vulnerability in BigProf productsBigProf Online Inventory Manager
- CVE-2023-6431Cross-site Scripting vulnerability in BigProf productsBigProf Online Inventory Manager
- CVE-2023-6430Cross-site Scripting vulnerability in BigProf productsBigProf Online Inventory Manager
- CVE-2023-34030WordPress Complianz and Complianz Premium plugins - Cross Site Request Forgery (CSRF)Really Simple Plugins Complianz
- CVE-2023-6429Cross-site Scripting vulnerability in BigProf productsBigProf Online Invoicing System
- CVE-2023-6428Cross-site Scripting vulnerability in BigProf productsBigProf Online Invoicing System
- CVE-2023-6427Cross-site Scripting vulnerability in BigProf productsBigProf Online Invoicing System
- CVE-2023-6426Cross-site Scripting vulnerability in BigProf productsBigProf Online Invoicing System
- CVE-2023-6425Cross-site Scripting vulnerability in BigProf productsBigProf Online Clinic Management System
- CVE-2023-6424Cross-site Scripting vulnerability in BigProf productsBigProf Online Clinic Management System
- CVE-2023-6423Cross-site Scripting vulnerability in BigProf productsBigProf Online Clinic Management System
- CVE-2023-6422Cross-site Scripting vulnerability in BigProf productsBigProf Online Clinic Management System
- CVE-2023-36685WordPress CartFlows Pro Plugin <= 1.11.12 is vulnerable to Cross Site Request Forgery (CSRF)Brainstorm Force US CartFlows Pro
- CVE-2023-6027Cross-site Scripting vulnerability in PHPMemcachedAdminPHPMemcachedAdmin · elijaa/phpmemcacheadmin
- CVE-2023-47645WordPress RegistrationMagic Plugin <= 5.2.2.6 is vulnerable to Cross Site Request Forgery (CSRF)RegistrationMagic – Custom Registration Forms, User Registr…
- CVE-2023-4770Uncontrolled Search Path Element Vulnerability in 4D and 4D Windows Server4D.exe · 4D Server.exe
- CVE-2023-47827WordPress Events Addon for Elementor Plugin <= 2.1.3 is vulnerable to Broken Access ControlNicheAddons Events Addon for Elementor
- CVE-2023-5966Unrestricted Upload of File with Dangerous Type in EspoCRMEspoCRM
- CVE-2023-5965Unrestricted Upload of File with Dangerous Type in EspoCRMEspoCRM
- CVE-2023-6420Cross-site Scripting vulnerability in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-6419Cross-site Scripting vulnerability in Voovi Social Networking ScriptVoovi Social Networking Script
- CVE-2023-48279WordPress Seraphinite Post .DOCX Source Plugin <= 2.16.6 is vulnerable to Cross Site Request Forgery (CSRF)Seraphinite Solutions Seraphinite Post .DOCX Source
- CVE-2023-48281WordPress Broken Link Checker for YouTube Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)Super Blog Me Broken Link Checker for YouTube
- CVE-2023-48282WordPress Taxonomy filter Plugin <= 2.2.9 is vulnerable to Cross Site Request Forgery (CSRF)Andrea Landonio Taxonomy filter
- CVE-2023-48283WordPress Simple Testimonials Showcase Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)PressTigers Simple Testimonials Showcase
- CVE-2023-48284WordPress Decorator – WooCommerce Email Customizer Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)WebToffee Decorator – WooCommerce Email Customizer
- CVE-2023-48323WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)Awesome Support Team Awesome Support – WordPress HelpDesk &…
- CVE-2023-48330WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)Mike Strand Bulk Comment Remove
- CVE-2023-48331WordPress MyBookTable Bookstore Plugin <= 3.3.4 is vulnerable to Cross Site Request Forgery (CSRF)MyBookTable Bookstore by Stormhill Media
- CVE-2023-48334WordPress League Table Plugin <= 1.13 is vulnerable to Cross Site Request Forgery (CSRF)DAEXT League Table
- CVE-2023-6137WordPress Frontier Post Plugin <= 6.1 is vulnerable to Cross Site Request Forgery (CSRF)finnj Frontier Post
- CVE-2023-48744WordPress Availability Calendar Plugin <= 1.2.6 is vulnerable to Cross Site Request Forgery (CSRF)Offshore Web Master Availability Calendar
- CVE-2023-32291WordPress MonsterInsights Pro Plugin <= 8.14.1 is vulnerable to Cross Site Scripting (XSS)MonsterInsights Pro
- CVE-2023-40674WordPress Simple URLs Plugin <= 118 is vulnerable to Cross Site Scripting (XSS)Lasso Simple URLs – Link Cloaking, Product Displays, and Af…
- CVE-2023-40680WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS)Team Yoast Yoast SEO
- CVE-2023-41127WordPress Evergreen Content Poster Plugin <= 1.3.6.1 is vulnerable to Cross Site Scripting (XSS)Evergreen Content Poster – Auto Post and Schedule Your Best…
- CVE-2023-41128WordPress WP Roadmap Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)Iqonic Design WP Roadmap – Product Feedback Board
- CVE-2023-41136WordPress Simple Long Form Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)Laurence/OhMyBox.info Simple Long Form
- CVE-2023-45050WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)Automattic Jetpack – WP Security, Backup, Speed, & Growth
- CVE-2023-47505WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)Elementor.com Elementor
- CVE-2023-47777WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityAutomattic WooCommerce
- CVE-2023-47850WordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS)Community by PeepSo – Social Network, Membership, Registrat…
- CVE-2023-49733Apache Cocoon's StreamGenerator is vulnerable to XXE injectionApache Software Foundation Apache Cocoon · org.apache.cocoo…
- CVE-2023-47851WordPress Bootstrap Shortcodes Ultimate Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate
- CVE-2023-47854WordPress Parallax Image Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)Howard Ehrenberg Parallax Image
- CVE-2023-48289WordPress Import Spreadsheets from Microsoft Excel Plugin <= 10.1.3 is vulnerable to Cross Site Scripting (XSS)SpreadsheetConverter Import Spreadsheets from Microsoft Exc…
- CVE-2023-48329WordPress Fast Custom Social Share by CodeBard Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)Fast Custom Social Share by CodeBard
- CVE-2023-48336WordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)cybernetikz Easy Social Icons
- CVE-2023-48737WordPress TriPay Payment Gateway Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)PT Trijaya Digital Grup TriPay Payment Gateway
- CVE-2023-48743WordPress Simply Exclude Plugin <= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS)Paul Menard Simply Exclude
- CVE-2021-36806 A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance Sophos Email Appliance
- CVE-2023-49620Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized forApache Software Foundation Apache DolphinScheduler · org… +3
- CVE-2023-49700Buffer Copy Without Checking size of input in IMSASR Falcon
- CVE-2023-49699Out-of-bounds access a buffer in IMSASR Falcon
- CVE-2023-49076Pimcore missing token/header to prevent CSRFpimcore customer-data-framework
- CVE-2023-49087Validation of SignedInfosimplesamlphp xml-security · simplesamlphp/xml-security +1
- CVE-2023-49094Symbolicator Server Side Request Forgery vulnerabilitygetsentry symbolicator
- CVE-2023-5772Debug Log Manager <= 2.2.0 - Cross-Site Request Forgeryqriouslad Debug Log Manager – Conveniently Monitor and Insp…
- CVE-2023-3741An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on theNEC Platforms ITK-6DGS-1(BK) TEL · NEC Platforms ITK-32… +20
- CVE-2021-35975Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.77
- CVE-2023-46326ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of the
- CVE-2023-46383LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-e
- CVE-2023-46384LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions.
- CVE-2023-46385LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions.
- CVE-2023-46386LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file.
- CVE-2023-46387LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file.
- CVE-2023-46388LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file.
- CVE-2023-46389LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file.
- CVE-2023-47307Buffer Overflow vulnerability in /apply.cgi in Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 allows attackers to cause a denia
- CVE-2023-47418Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service manage
- CVE-2023-47452An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the
- CVE-2023-47453An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll
- CVE-2023-47454An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated privileges through the
- CVE-2023-47464Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the u
- CVE-2023-48803In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48804In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48805In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48806In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48807In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48808In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48810In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48811In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str
- CVE-2023-48812In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str f
- CVE-2023-48894Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function.
- CVE-2023-48912Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.
- CVE-2023-48913Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.
- CVE-2023-48914Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.
- CVE-2023-48963Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget.
- CVE-2023-48964Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/WifiMacFilterSet.
- CVE-2023-49052File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload fmicroweber/microweber