# CVEs published 2023-11-30

205 CVEs were published on November 30, 2023: 19 critical, 37 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-42917](https://cve.now/CVE-2023-42917.md): A memory corruption vulnerability was addressed with improved locking. (CVSS 8.8, KEV, Apple Safari · Apple macOS +1)
- [CVE-2023-42916](https://cve.now/CVE-2023-42916.md): An out-of-bounds read was addressed with improved input validation. (CVSS 6.5, KEV, Apple Safari · Apple macOS +1)
- [CVE-2023-47279](https://cve.now/CVE-2023-47279.md): Delta Electronics InfraSuite Device Master Path Traversal (CVSS 7.5, Delta Electronics InfraSuite Device Master)
- [CVE-2023-47207](https://cve.now/CVE-2023-47207.md): Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-46690](https://cve.now/CVE-2023-46690.md): Delta Electronics InfraSuite Device Master Path Traversal (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-5909](https://cve.now/CVE-2023-5909.md): Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx (CVSS 7.5, PTC KEPServerEX · PTC ThingWorx Kepware Server +6)
- [CVE-2023-39226](https://cve.now/CVE-2023-39226.md): Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or Function (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-5908](https://cve.now/CVE-2023-5908.md): Heap Based Buffer Overflow in PTC KEPServerEx (CVSS 9.1, PTC KEPServerEX · PTC ThingWorx Kepware Server +6)
- [CVE-2023-49735](https://cve.now/CVE-2023-49735.md): Apache Tiles: Unvalidated input may lead to path traversal and XXE (low (no CVSS), Apache Software Foundation Apache Tiles · org.apache.til… +2)
- [CVE-2023-6442](https://cve.now/CVE-2023-6442.md): PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php cross site scripting (CVSS 3.5, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2023-6440](https://cve.now/CVE-2023-6440.md): SourceCodester Book Borrower System add-book.php cross site scripting (CVSS 3.5, SourceCodester Book Borrower System)
- [CVE-2023-6439](https://cve.now/CVE-2023-6439.md): ZenTao PMS cross site scripting (CVSS 3.5, ZenTao PMS)
- [CVE-2023-6352](https://cve.now/CVE-2023-6352.md): Aquaforest TIFF Server default configuration allows access to arbitrary files (CVSS 5.3, Aquaforest TIFF Server)
- [CVE-2023-6376](https://cve.now/CVE-2023-6376.md): Henschen & Associates court document management software cache uses predictable file names (CVSS 5.3, Henschen & Associates court document management software)
- [CVE-2023-6375](https://cve.now/CVE-2023-6375.md): Tyler Technologies Magistrate Court Case Management Plus stores backups insecurely (CVSS 5.3, Tyler Technologies Court Case Management Plus)
- [CVE-2023-6354](https://cve.now/CVE-2023-6354.md): Tyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypass (CVSS 5.3, Tyler Technologies Magistrate Court Case Management Plus)
- [CVE-2023-6353](https://cve.now/CVE-2023-6353.md): Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass (CVSS 5.3, Tyler Technologies Civil and Criminal Electronic Filing)
- [CVE-2023-6344](https://cve.now/CVE-2023-6344.md): Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server te003.aspx and te004.aspx allows authentication bypass (CVSS 5.3, Tyler Technologies Court Case Management Plus)
- [CVE-2023-6343](https://cve.now/CVE-2023-6343.md): Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server tssp.aspx allows authentication bypass (CVSS 5.3, Tyler Technologies Court Case Management Plus)
- [CVE-2023-6341](https://cve.now/CVE-2023-6341.md): Catalis CM360 allows authentication bypass (CVSS 5.3, Catalis CMS360)
- [CVE-2023-6342](https://cve.now/CVE-2023-6342.md): Tyler Technologies Court Case Management Plus "pay for print" allows authentication bypass (CVSS 5.3, Tyler Technologies Court Case Management Plus)
- [CVE-2023-47870](https://cve.now/CVE-2023-47870.md): WordPress wpForo Forum Plugin \<= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF) (CVSS 7.1, gVectors Team wpForo Forum)
- [CVE-2023-34018](https://cve.now/CVE-2023-34018.md): WordPress SoundCloud Shortcode Plugin \<= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, SoundCloud Shortcode)
- [CVE-2023-6438](https://cve.now/CVE-2023-6438.md): Thecosy IceCMS Like improper enforcement of a single, unique action (CVSS 4.3, Thecosy IceCMS)
- [CVE-2023-47521](https://cve.now/CVE-2023-47521.md): WordPress Q2W3 Post Order Plugin \<= 1.2.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Max Bond, AndreSC Q2W3 Post Order)
- [CVE-2023-2267](https://cve.now/CVE-2023-2267.md): Improper input validation could lead to reflection injection attacks (CVSS 4.3, Schweitzer Engineering Laboratories SEL-411L)
- [CVE-2023-2266](https://cve.now/CVE-2023-2266.md): Improper neutralization of input during web page generation could lead to cross-site scripting based attacks (CVSS 4.3, Schweitzer Engineering Laboratories SEL-411L)
- [CVE-2023-38400](https://cve.now/CVE-2023-38400.md): WordPress Enfold Theme \<= 5.6.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Kriesi Enfold - Responsive Multi-Purpose Theme)
- [CVE-2023-2265](https://cve.now/CVE-2023-2265.md): Improper restriction of rendered UI layers or frames could lead to clickjacking attack (CVSS 4.3, Schweitzer Engineering Laboratories SEL-411L)
- [CVE-2023-2264](https://cve.now/CVE-2023-2264.md): Improper input validition could lead to code injection (CVSS 4.0, Schweitzer Engineering Laboratories SEL-411L)
- [CVE-2023-34390](https://cve.now/CVE-2023-34390.md): Improper input validation could lead to denial of service (CVSS 4.5, Schweitzer Engineering Laboratories SEL-451)
- [CVE-2023-34389](https://cve.now/CVE-2023-34389.md): Allocation of resources without limits could lead to denial of service (CVSS 4.5, Schweitzer Engineering Laboratories SEL-451)
- [CVE-2023-47844](https://cve.now/CVE-2023-47844.md): WordPress Grab & Save Plugin \<= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Lim Kai Yang Grab & Save)
- [CVE-2023-34388](https://cve.now/CVE-2023-34388.md): Improper authentication could lead to session hijacking (CVSS 6.5, Schweitzer Engineering Laboratories SEL-451)
- [CVE-2023-31177](https://cve.now/CVE-2023-31177.md): Improper neutralizataion of input could lead to execution of arbitrary code (CVSS 4.3, Schweitzer Engineering Laboratories SEL-451)
- [CVE-2023-31176](https://cve.now/CVE-2023-31176.md): Insufficient entropy vulnerability could lead to authentication bypass (CVSS 7.5, Schweitzer Engineering Laboratories SEL-451)
- [CVE-2023-47848](https://cve.now/CVE-2023-47848.md): WordPress Tainacan Plugin \<= 0.20.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Tainacan.org Tainacan)
- [CVE-2023-47853](https://cve.now/CVE-2023-47853.md): WordPress myCred Plugin \<= 2.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, myCred – Points, Rewards, Gamification, Ranks, Badges & Loy…)
- [CVE-2023-47872](https://cve.now/CVE-2023-47872.md): WordPress wpForo Forum Plugin \<= 2.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, gVectors Team wpForo Forum)
- [CVE-2023-47876](https://cve.now/CVE-2023-47876.md): WordPress Perfmatters Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Perfmatters)
- [CVE-2023-47877](https://cve.now/CVE-2023-47877.md): WordPress Perfmatters Plugin \< 2.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Perfmatters)
- [CVE-2023-48272](https://cve.now/CVE-2023-48272.md): WordPress Maspik – Spam blacklist Plugin \<= 0.9.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, yonifre Maspik – Spam Blacklist)
- [CVE-2023-48317](https://cve.now/CVE-2023-48317.md): WordPress Display Custom Post Plugin \<= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Vikas Vatsa Display Custom Post)
- [CVE-2023-48320](https://cve.now/CVE-2023-48320.md): WordPress Video Player Plugin \<= 1.5.22 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WebDorado SpiderVPlayer)
- [CVE-2023-48321](https://cve.now/CVE-2023-48321.md): WordPress Accelerated Mobile Pages Plugin \<= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobi…)
- [CVE-2023-48746](https://cve.now/CVE-2023-48746.md): WordPress Community by PeepSo Plugin \<= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Community by PeepSo – Social Network, Membership, Registrat…)
- [CVE-2023-48748](https://cve.now/CVE-2023-48748.md): WordPress Salient Core Plugin \<= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Theme nectar Salient Core)
- [CVE-2023-48752](https://cve.now/CVE-2023-48752.md): WordPress Happyforms Plugin \<= 1.25.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Form builder to get in touch with visitors, grow your email…)
- [CVE-2023-48749](https://cve.now/CVE-2023-48749.md): WordPress Salient Core Plugin \<= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Theme nectar Salient Core)
- [CVE-2023-47875](https://cve.now/CVE-2023-47875.md): WordPress Perfmatters Plugin \<= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Perfmatters)
- [CVE-2023-48278](https://cve.now/CVE-2023-48278.md): WordPress WP Forms Puzzle Captcha Plugin \<= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to XSS (CVSS 7.1, Nitin Rathod WP Forms Puzzle Captcha)
- [CVE-2023-48328](https://cve.now/CVE-2023-48328.md): WordPress NextGEN Gallery Plugin \<= 3.37 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Imagely WordPress Gallery Plugin – NextGEN Gallery)
- [CVE-2023-48754](https://cve.now/CVE-2023-48754.md): WordPress Delete Post Revisions In WordPress Plugin \<= 4.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Wap Nepal Delete Post Revisions In WordPress)
- [CVE-2023-5803](https://cve.now/CVE-2023-5803.md): WordPress Business Directory Plugin Plugin \<= 6.3.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Business Directory Team Business Directory Plugin – Easy Li…)
- [CVE-2023-44143](https://cve.now/CVE-2023-44143.md): WordPress Bamboo Columns Plugin \<= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Bamboo Mcr Bamboo Columns)
- [CVE-2023-45609](https://cve.now/CVE-2023-45609.md): WordPress Powr Pack Plugin \<= 2.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, POWR.io Contact Form – Custom Builder, Payment Form, and Mo…)
- [CVE-2023-46086](https://cve.now/CVE-2023-46086.md): WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin \<= 3.4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, SERVIT Software Solutions affiliate-toolkit – WordPress Aff…)
- [CVE-2023-39921](https://cve.now/CVE-2023-39921.md): WordPress Molongui Plugin \<= 4.6.19 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Author Box, Guest Author and Co-Authors for Your Posts – Mo…)
- [CVE-2023-25057](https://cve.now/CVE-2023-25057.md): WordPress Libsyn Publisher Hub Plugin \<= 1.3.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Libsyn Publisher Hub)
- [CVE-2023-26533](https://cve.now/CVE-2023-26533.md): WordPress Zippy Plugin \<= 1.6.1 is vulnerable to Sensitive Data Exposure (CVSS 6.5, Gesundheit Bewegt Zippy)
- [CVE-2023-36507](https://cve.now/CVE-2023-36507.md): WordPress BookingPress Plugin \<= 1.0.64 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Repute Infosystems BookingPress – Appointment Booking Calen…)
- [CVE-2023-36523](https://cve.now/CVE-2023-36523.md): WordPress Email download link Plugin \<= 3.7 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Gopi Ramasamy Email download link)
- [CVE-2023-37868](https://cve.now/CVE-2023-37868.md): WordPress Premium Addons PRO Plugin \<= 2.9.0 is vulnerable to Sensitive Data Exposure (CVSS 6.5, Leap13 Premium Addons PRO)
- [CVE-2023-6360](https://cve.now/CVE-2023-6360.md): The 'My Calendar' WordPress Plugin, version \< 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' pa (CVSS 8.6, my-calendar)
- [CVE-2023-37890](https://cve.now/CVE-2023-37890.md): WordPress KB Support Plugin \<= 1.5.88 is vulnerable to Broken Access Control (CVSS 4.3, WPOmnia KB Support – WordPress Help Desk and Knowledge Base)
- [CVE-2023-37972](https://cve.now/CVE-2023-37972.md): WordPress WooCommerce Product Stock Alert Plugin \<= 2.0.1 is vulnerable to Sensitive Data Exposure (CVSS 5.3, MultiVendorX Product Stock Manager & Notifier for WooCommer…)
- [CVE-2023-40211](https://cve.now/CVE-2023-40211.md): WordPress Post Grid Plugin \<= 2.2.50 is vulnerable to Sensitive Data Exposure (CVSS 7.5, PickPlugins Post Grid Combo – 36+ Gutenberg Blocks)
- [CVE-2023-40600](https://cve.now/CVE-2023-40600.md): WordPress EWWW Image Optimizer Plugin \<= 7.2.0 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Exactly WWW EWWW Image Optimizer)
- [CVE-2023-6402](https://cve.now/CVE-2023-6402.md): PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php sql injection (CVSS 6.3, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2023-40662](https://cve.now/CVE-2023-40662.md): WordPress Cookies and Content Security Policy Plugin \<= 2.15 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Jonk @ Follow me Darling Cookies and Content Security Policy)
- [CVE-2023-41735](https://cve.now/CVE-2023-41735.md): WordPress Email posts to subscribers Plugin \<= 6.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Gopi Ramasamy Email posts to subscribers)
- [CVE-2023-44150](https://cve.now/CVE-2023-44150.md): WordPress ProfilePress Plugin \<= 4.13.2 is vulnerable to Sensitive Data Exposure (CVSS 7.5, ProfilePress Membership Team Paid Membership Plugin, Ecomme…)
- [CVE-2023-45066](https://cve.now/CVE-2023-45066.md): WordPress WP Ultimate Exporter Plugin \<= 2.4.1 is vulnerable to Sensitive Data Exposure (CVSS 5.9, Smackcoders Export All Posts, Products, Orders, Refunds & U…)
- [CVE-2023-45834](https://cve.now/CVE-2023-45834.md): WordPress Libsyn Publisher Hub Plugin \<= 1.4.4 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Libsyn Publisher Hub)
- [CVE-2023-46820](https://cve.now/CVE-2023-46820.md): WordPress Image Regenerate & Select Crop Plugin \<= 7.3.0 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Iulia Cazan Image Regenerate & Select Crop)
- [CVE-2023-6401](https://cve.now/CVE-2023-6401.md): NotePad++ dbghelp.exe uncontrolled search path (CVSS 5.3, NotePad++)
- [CVE-2023-48333](https://cve.now/CVE-2023-48333.md): WordPress Booster for WooCommerce Plugin \<= 7.1.1 is vulnerable to Sensitive Data Exposure (CVSS 6.5, Pluggabl Booster for WooCommerce)
- [CVE-2023-6136](https://cve.now/CVE-2023-6136.md): WordPress Debug Log Manager Plugin \<= 2.3.0 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Bowo Debug Log Manager)
- [CVE-2023-37867](https://cve.now/CVE-2023-37867.md): WordPress Yet Another Stars Rating Plugin \<= 3.3.8 is vulnerable to Race Condition (CVSS 3.7, YetAnotherStarsRating.com YASR – Yet Another Star Rating Pl…)
- [CVE-2023-48742](https://cve.now/CVE-2023-48742.md): WordPress License Manager for WooCommerce Plugin \<= 2.2.10 is vulnerable to SQL Injection (CVSS 7.6, LicenseManager License Manager for WooCommerce)
- [CVE-2023-33333](https://cve.now/CVE-2023-33333.md): WordPress Complianz and Complianz Premium plugins - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) (CVSS 7.1, Really Simple Plugins Complianz)
- [CVE-2023-6435](https://cve.now/CVE-2023-6435.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Inventory Manager)
- [CVE-2023-6434](https://cve.now/CVE-2023-6434.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Inventory Manager)
- [CVE-2023-6433](https://cve.now/CVE-2023-6433.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Inventory Manager)
- [CVE-2023-6432](https://cve.now/CVE-2023-6432.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Inventory Manager)
- [CVE-2023-6431](https://cve.now/CVE-2023-6431.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Inventory Manager)
- [CVE-2023-6430](https://cve.now/CVE-2023-6430.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Inventory Manager)
- [CVE-2023-34030](https://cve.now/CVE-2023-34030.md): WordPress Complianz and Complianz Premium plugins - Cross Site Request Forgery (CSRF) (CVSS 6.5, Really Simple Plugins Complianz)
- [CVE-2023-6429](https://cve.now/CVE-2023-6429.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Invoicing System)
- [CVE-2023-6428](https://cve.now/CVE-2023-6428.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Invoicing System)
- [CVE-2023-6427](https://cve.now/CVE-2023-6427.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Invoicing System)
- [CVE-2023-6426](https://cve.now/CVE-2023-6426.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Invoicing System)
- [CVE-2023-6425](https://cve.now/CVE-2023-6425.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Clinic Management System)
- [CVE-2023-6424](https://cve.now/CVE-2023-6424.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Clinic Management System)
- [CVE-2023-6423](https://cve.now/CVE-2023-6423.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Clinic Management System)
- [CVE-2023-6422](https://cve.now/CVE-2023-6422.md): Cross-site Scripting vulnerability in BigProf products (CVSS 6.3, BigProf Online Clinic Management System)
- [CVE-2023-36682](https://cve.now/CVE-2023-36682.md): WordPress Schema Pro Plugin \<= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Brainstorm Force US Schema Pro)
- [CVE-2023-36685](https://cve.now/CVE-2023-36685.md): WordPress CartFlows Pro Plugin \<= 1.11.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Brainstorm Force US CartFlows Pro)
- [CVE-2023-6027](https://cve.now/CVE-2023-6027.md): Cross-site Scripting vulnerability in PHPMemcachedAdmin (CVSS 6.1, PHPMemcachedAdmin · elijaa/phpmemcacheadmin)
- [CVE-2023-6026](https://cve.now/CVE-2023-6026.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in PHPMemcachedAdmin (CVSS 9.8, PHPMemcachedAdmin · elijaa/phpmemcacheadmin)
- [CVE-2023-47645](https://cve.now/CVE-2023-47645.md): WordPress RegistrationMagic Plugin \<= 5.2.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, RegistrationMagic – Custom Registration Forms, User Registr…)
- [CVE-2023-4770](https://cve.now/CVE-2023-4770.md): Uncontrolled Search Path Element Vulnerability in 4D and 4D Windows Server (CVSS 6.5, 4D.exe · 4D Server.exe)
- [CVE-2023-47827](https://cve.now/CVE-2023-47827.md): WordPress Events Addon for Elementor Plugin \<= 2.1.3 is vulnerable to Broken Access Control (CVSS 6.5, NicheAddons Events Addon for Elementor)
- [CVE-2023-5966](https://cve.now/CVE-2023-5966.md): Unrestricted Upload of File with Dangerous Type in EspoCRM (CVSS 4.7, EspoCRM)
- [CVE-2023-5965](https://cve.now/CVE-2023-5965.md): Unrestricted Upload of File with Dangerous Type in EspoCRM (CVSS 4.7, EspoCRM)
- [CVE-2023-6420](https://cve.now/CVE-2023-6420.md): Cross-site Scripting vulnerability in Voovi Social Networking Script (CVSS 6.5, Voovi Social Networking Script)
- [CVE-2023-6419](https://cve.now/CVE-2023-6419.md): Cross-site Scripting vulnerability in Voovi Social Networking Script (CVSS 6.5, Voovi Social Networking Script)
- [CVE-2023-6418](https://cve.now/CVE-2023-6418.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-48279](https://cve.now/CVE-2023-48279.md): WordPress Seraphinite Post .DOCX Source Plugin \<= 2.16.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Seraphinite Solutions Seraphinite Post .DOCX Source)
- [CVE-2023-6417](https://cve.now/CVE-2023-6417.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-6416](https://cve.now/CVE-2023-6416.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-6415](https://cve.now/CVE-2023-6415.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-6414](https://cve.now/CVE-2023-6414.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-6413](https://cve.now/CVE-2023-6413.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-6412](https://cve.now/CVE-2023-6412.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-6411](https://cve.now/CVE-2023-6411.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-6410](https://cve.now/CVE-2023-6410.md): SQL injection in Voovi Social Networking Script (CVSS 9.8, Voovi Social Networking Script)
- [CVE-2023-48281](https://cve.now/CVE-2023-48281.md): WordPress Broken Link Checker for YouTube Plugin \<= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Super Blog Me Broken Link Checker for YouTube)
- [CVE-2023-48282](https://cve.now/CVE-2023-48282.md): WordPress Taxonomy filter Plugin \<= 2.2.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Andrea Landonio Taxonomy filter)
- [CVE-2023-48283](https://cve.now/CVE-2023-48283.md): WordPress Simple Testimonials Showcase Plugin \<= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, PressTigers Simple Testimonials Showcase)
- [CVE-2023-48284](https://cve.now/CVE-2023-48284.md): WordPress Decorator – WooCommerce Email Customizer Plugin \<= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WebToffee Decorator – WooCommerce Email Customizer)
- [CVE-2023-48323](https://cve.now/CVE-2023-48323.md): WordPress Awesome Support Plugin \<= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Awesome Support Team Awesome Support – WordPress HelpDesk &…)
- [CVE-2023-48330](https://cve.now/CVE-2023-48330.md): WordPress Bulk Comment Remove Plugin \<= 2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Mike Strand Bulk Comment Remove)
- [CVE-2023-48331](https://cve.now/CVE-2023-48331.md): WordPress MyBookTable Bookstore Plugin \<= 3.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, MyBookTable Bookstore by Stormhill Media)
- [CVE-2023-48334](https://cve.now/CVE-2023-48334.md): WordPress League Table Plugin \<= 1.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, DAEXT League Table)
- [CVE-2023-6137](https://cve.now/CVE-2023-6137.md): WordPress Frontier Post Plugin \<= 6.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, finnj Frontier Post)
- [CVE-2023-6071](https://cve.now/CVE-2023-6071.md): An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator (CVSS 8.4, Trellix ESM)
- [CVE-2023-48744](https://cve.now/CVE-2023-48744.md): WordPress Availability Calendar Plugin \<= 1.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Offshore Web Master Availability Calendar)
- [CVE-2023-32291](https://cve.now/CVE-2023-32291.md): WordPress MonsterInsights Pro Plugin \<= 8.14.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, MonsterInsights Pro)
- [CVE-2023-38474](https://cve.now/CVE-2023-38474.md): WordPress Campaign Monitor for WordPress Plugin \<= 2.8.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Campaign Monitor for WordPress)
- [CVE-2023-40674](https://cve.now/CVE-2023-40674.md): WordPress Simple URLs Plugin \<= 118 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Lasso Simple URLs – Link Cloaking, Product Displays, and Af…)
- [CVE-2023-40680](https://cve.now/CVE-2023-40680.md): WordPress Yoast SEO Plugin \<= 21.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Team Yoast Yoast SEO)
- [CVE-2023-41127](https://cve.now/CVE-2023-41127.md): WordPress Evergreen Content Poster Plugin \<= 1.3.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Evergreen Content Poster – Auto Post and Schedule Your Best…)
- [CVE-2023-41128](https://cve.now/CVE-2023-41128.md): WordPress WP Roadmap Plugin \<= 1.0.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Iqonic Design WP Roadmap – Product Feedback Board)
- [CVE-2023-41136](https://cve.now/CVE-2023-41136.md): WordPress Simple Long Form Plugin \<= 2.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Laurence/OhMyBox.info Simple Long Form)
- [CVE-2023-45050](https://cve.now/CVE-2023-45050.md): WordPress Jetpack Plugin \<= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Automattic Jetpack – WP Security, Backup, Speed, & Growth)
- [CVE-2023-47505](https://cve.now/CVE-2023-47505.md): WordPress Elementor Website Builder Plugin \<= 3.16.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Elementor.com Elementor)
- [CVE-2023-47777](https://cve.now/CVE-2023-47777.md): WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic WooCommerce)
- [CVE-2023-47850](https://cve.now/CVE-2023-47850.md): WordPress Community by PeepSo Plugin \<= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Community by PeepSo – Social Network, Membership, Registrat…)
- [CVE-2023-49733](https://cve.now/CVE-2023-49733.md): Apache Cocoon's StreamGenerator is vulnerable to XXE injection (no CVSS, Apache Software Foundation Apache Cocoon · org.apache.cocoo…)
- [CVE-2023-47851](https://cve.now/CVE-2023-47851.md): WordPress Bootstrap Shortcodes Ultimate Plugin \<= 4.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate)
- [CVE-2023-47854](https://cve.now/CVE-2023-47854.md): WordPress Parallax Image Plugin \<= 1.7.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Howard Ehrenberg Parallax Image)
- [CVE-2023-48289](https://cve.now/CVE-2023-48289.md): WordPress Import Spreadsheets from Microsoft Excel Plugin \<= 10.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, SpreadsheetConverter Import Spreadsheets from Microsoft Exc…)
- [CVE-2023-48322](https://cve.now/CVE-2023-48322.md): WordPress eDoc Employee Job Application Plugin \<= 1.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, eDoc Intelligence eDoc Employee Job Application – Best Word…)
- [CVE-2023-48326](https://cve.now/CVE-2023-48326.md): WordPress Events Manager Plugin \<= 6.4.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Pixelite Events Manager)
- [CVE-2023-48329](https://cve.now/CVE-2023-48329.md): WordPress Fast Custom Social Share by CodeBard Plugin \<= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Fast Custom Social Share by CodeBard)
- [CVE-2023-48336](https://cve.now/CVE-2023-48336.md): WordPress Easy Social Icons Plugin \<= 3.2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, cybernetikz Easy Social Icons)
- [CVE-2023-48737](https://cve.now/CVE-2023-48737.md): WordPress TriPay Payment Gateway Plugin \<= 3.2.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PT Trijaya Digital Grup TriPay Payment Gateway)
- [CVE-2023-48743](https://cve.now/CVE-2023-48743.md): WordPress Simply Exclude Plugin \<= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Paul Menard Simply Exclude)
- [CVE-2021-36806](https://cve.now/CVE-2021-36806.md): A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance (CVSS 4.7, Sophos Email Appliance)
- [CVE-2023-49620](https://cve.now/CVE-2023-49620.md): Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for (no CVSS, Apache Software Foundation Apache DolphinScheduler · org… +3)
- [CVE-2022-45135](https://cve.now/CVE-2022-45135.md): Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction (CVSS 9.8, Apache Software Foundation Apache Cocoon · org.apache.cocoo…)
- [CVE-2023-49701](https://cve.now/CVE-2023-49701.md): Out-of-bounds access a buffer in SIM management (CVSS 7.2, ASR Falcon)
- [CVE-2023-49077](https://cve.now/CVE-2023-49077.md): mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation (CVSS 8.3, mailcow-dockerized)
- [CVE-2023-49700](https://cve.now/CVE-2023-49700.md): Buffer Copy Without Checking size of input in IMS (CVSS 6.7, ASR Falcon)
- [CVE-2023-49095](https://cve.now/CVE-2023-49095.md): nexkey allows arbitrary users to impersonate any remote user due to missing signature validation (CVSS 8.6, nexryai nexkey)
- [CVE-2023-49699](https://cve.now/CVE-2023-49699.md): Out-of-bounds access a buffer in IMS (CVSS 6.7, ASR Falcon)
- [CVE-2023-49081](https://cve.now/CVE-2023-49081.md): aiohttp's ClientSession is vulnerable to CRLF injection via version (CVSS 7.2, aio-libs aiohttp · aiohttp)
- [CVE-2023-49076](https://cve.now/CVE-2023-49076.md): Pimcore missing token/header to prevent CSRF (CVSS 4.3, pimcore customer-data-framework)
- [CVE-2023-49087](https://cve.now/CVE-2023-49087.md): Validation of SignedInfo (CVSS 6.8, simplesamlphp xml-security · simplesamlphp/xml-security +1)
- [CVE-2023-49094](https://cve.now/CVE-2023-49094.md): Symbolicator Server Side Request Forgery vulnerability (CVSS 4.3, getsentry symbolicator)
- [CVE-2023-49097](https://cve.now/CVE-2023-49097.md): ZITADEL vulnerable account takeover via malicious host header injection (CVSS 8.1, zitadel · github.com/zitadel/zitadel)
- [CVE-2023-5247](https://cve.now/CVE-2023-5247.md): Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software (CVSS 7.8, Mitsubishi Electric GX Works3 · Mitsubishi Electric MELS… +2)
- [CVE-2023-5772](https://cve.now/CVE-2023-5772.md): Debug Log Manager \<= 2.2.0 - Cross-Site Request Forgery (CVSS 4.3, qriouslad Debug Log Manager – Conveniently Monitor and Insp…)
- [CVE-2023-4474](https://cve.now/CVE-2023-4474.md): The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware (CVSS 9.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2023-4473](https://cve.now/CVE-2023-4473.md): A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21( (CVSS 9.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2023-37928](https://cve.now/CVE-2023-37928.md): A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 fi (CVSS 8.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2023-37927](https://cve.now/CVE-2023-37927.md): The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware (CVSS 8.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2023-35138](https://cve.now/CVE-2023-35138.md): A command injection vulnerability in the “show\_zysync\_server\_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NA (CVSS 9.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2023-35137](https://cve.now/CVE-2023-35137.md): An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmw (CVSS 7.5, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2023-3741](https://cve.now/CVE-2023-3741.md): An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the (no CVSS, NEC Platforms ITK-6DGS-1(BK) TEL · NEC Platforms ITK-32… +20)
- [CVE-2021-35975](https://cve.now/CVE-2021-35975.md): Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.77 (no CVSS)
- [CVE-2023-46326](https://cve.now/CVE-2023-46326.md): ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of the (no CVSS)
- [CVE-2023-46383](https://cve.now/CVE-2023-46383.md): LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-e (no CVSS)
- [CVE-2023-46384](https://cve.now/CVE-2023-46384.md): LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. (no CVSS)
- [CVE-2023-46385](https://cve.now/CVE-2023-46385.md): LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. (no CVSS)
- [CVE-2023-46386](https://cve.now/CVE-2023-46386.md): LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. (no CVSS)
- [CVE-2023-46387](https://cve.now/CVE-2023-46387.md): LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal\_config.zml file. (no CVSS)
- [CVE-2023-46388](https://cve.now/CVE-2023-46388.md): LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal\_config.zml file. (no CVSS)
- [CVE-2023-46389](https://cve.now/CVE-2023-46389.md): LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. (no CVSS)
- [CVE-2023-46956](https://cve.now/CVE-2023-46956.md): SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted pay (CVSS 7.2)
- [CVE-2023-47307](https://cve.now/CVE-2023-47307.md): Buffer Overflow vulnerability in /apply.cgi in Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 allows attackers to cause a denia (no CVSS)
- [CVE-2023-47418](https://cve.now/CVE-2023-47418.md): Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service manage (no CVSS)
- [CVE-2023-47452](https://cve.now/CVE-2023-47452.md): An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the (no CVSS)
- [CVE-2023-47453](https://cve.now/CVE-2023-47453.md): An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll (no CVSS)
- [CVE-2023-47454](https://cve.now/CVE-2023-47454.md): An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated privileges through the (no CVSS)
- [CVE-2023-47463](https://cve.now/CVE-2023-47463.md): Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a cra (CVSS 9.8)
- [CVE-2023-47464](https://cve.now/CVE-2023-47464.md): Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the u (no CVSS)
- [CVE-2023-48802](https://cve.now/CVE-2023-48802.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (CVSS 9.8)
- [CVE-2023-48803](https://cve.now/CVE-2023-48803.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48804](https://cve.now/CVE-2023-48804.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48805](https://cve.now/CVE-2023-48805.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48806](https://cve.now/CVE-2023-48806.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48807](https://cve.now/CVE-2023-48807.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48808](https://cve.now/CVE-2023-48808.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48810](https://cve.now/CVE-2023-48810.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48811](https://cve.now/CVE-2023-48811.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file, sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str (no CVSS)
- [CVE-2023-48812](https://cve.now/CVE-2023-48812.md): In TOTOLINK X6000R V9.4.0cu.852\_B20230719, the shttpd file sub\_4119A0 function obtains fields from the front-end through Uci\_ Set\_ The Str f (no CVSS)
- [CVE-2023-48894](https://cve.now/CVE-2023-48894.md): Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function. (no CVSS)
- [CVE-2023-48912](https://cve.now/CVE-2023-48912.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit. (no CVSS)
- [CVE-2023-48913](https://cve.now/CVE-2023-48913.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete. (no CVSS)
- [CVE-2023-48914](https://cve.now/CVE-2023-48914.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add. (no CVSS)
- [CVE-2023-48963](https://cve.now/CVE-2023-48963.md): Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget. (no CVSS)
- [CVE-2023-48964](https://cve.now/CVE-2023-48964.md): Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/WifiMacFilterSet. (no CVSS)
- [CVE-2023-49052](https://cve.now/CVE-2023-49052.md): File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload f (no CVSS, microweber/microweber)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.