# CVEs published 2023-12-26

69 CVEs were published on December 26, 2023: 2 critical, 8 high. Days are UTC.

- [CVE-2023-5991](https://cve.now/CVE-2023-5991.md): Hotel Booking Lite \< 4.8.5 - Unauthenticated Arbitrary File Download & Deletion (no CVSS, Hotel Booking Lite)
- [CVE-2023-5980](https://cve.now/CVE-2023-5980.md): BSK Forms Blacklist \< 3.7 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, BSK Forms Blacklist)
- [CVE-2023-6114](https://cve.now/CVE-2023-6114.md): Duplicator \< 1.5.7.1; Duplicator Pro \< 4.5.14.2 - Unauthenticated Sensitive Data Exposure (no CVSS, Duplicator)
- [CVE-2023-6155](https://cve.now/CVE-2023-6155.md): Quiz Maker \< 6.4.9.5 - Unauthenticated Email Address Disclosure (CVSS 5.3, Quiz Maker)
- [CVE-2023-6250](https://cve.now/CVE-2023-6250.md): BestWebSoft's Like & Share \< 2.74 - Unauthenticated Password Protected Post Read (no CVSS, BestWebSoft's Like & Share)
- [CVE-2023-5939](https://cve.now/CVE-2023-5939.md): rtMedia for WordPress, BuddyPress and bbPress \< 4.6.16 - Admin+ RCE (no CVSS, rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2023-5672](https://cve.now/CVE-2023-5672.md): WP Mail Log \< 1.1.3 – Contributor+ LFI in wml\_logs/send\_mail endpoint (no CVSS, WP Mail Log)
- [CVE-2023-5644](https://cve.now/CVE-2023-5644.md): WP Mail Log \< 1.1.3 – Incorrect Authorization in REST API Endpoints (CVSS 7.6, WP Mail Log)
- [CVE-2023-5203](https://cve.now/CVE-2023-5203.md): WP Sessions Time Monitoring Full Automatic \< 1.0.9 - Unauthenticated SQL injection (CVSS 7.5, WP Sessions Time Monitoring Full Automatic)
- [CVE-2023-5645](https://cve.now/CVE-2023-5645.md): WP Mail Log \< 1.1.3 – Contributor+ SQL Injection in wml\_logs endpoint (no CVSS, WP Mail Log)
- [CVE-2023-6268](https://cve.now/CVE-2023-6268.md): JSON Content Importer \< 1.5.4 - Reflected XSS (no CVSS, JSON Content Importer)
- [CVE-2023-5673](https://cve.now/CVE-2023-5673.md): WP Mail Log \< 1.1.3 – Contributor+ Arbitrary File Upload to RCE (no CVSS, WP Mail Log)
- [CVE-2023-5674](https://cve.now/CVE-2023-5674.md): WP Mail Log \< 1.1.3 – Contributor+ SQL Injection in wml\_logs/send\_mail endpoint (no CVSS, WP Mail Log)
- [CVE-2023-6166](https://cve.now/CVE-2023-6166.md): Quiz Maker \< 6.4.9.5 - Reflected Cross-Site Scripting (no CVSS, Quiz Maker)
- [CVE-2023-5931](https://cve.now/CVE-2023-5931.md): rtMedia for WordPress, BuddyPress and bbPress \< 4.6.16 - Subscriber+ RCE (no CVSS, rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2015-10127](https://cve.now/CVE-2015-10127.md): PlusCaptcha Plugin cross site scripting (CVSS 3.5, PlusCaptcha Plugin)
- [CVE-2014-125109](https://cve.now/CVE-2014-125109.md): BestWebSoft Portfolio Plugin bws\_menu.php bws\_add\_menu\_render cross site scripting (CVSS 3.5, BestWebSoft Portfolio Plugin)
- [CVE-2023-51467](https://cve.now/CVE-2023-51467.md): Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability (critical (no CVSS), Apache Software Foundation Apache OFBiz)
- [CVE-2023-50968](https://cve.now/CVE-2023-50968.md): Apache OFBiz: Arbitrary file properties reading and SSRF attack (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2012-10017](https://cve.now/CVE-2012-10017.md): BestWebSoft Portfolio Plugin cross-site request forgery (CVSS 4.3, BestWebSoft Portfolio Plugin)
- [CVE-2023-5180](https://cve.now/CVE-2023-5180.md): Out-of-bounds Write vulnerability exists in ODA Drawings SDK before 2024.12 (CVSS 7.8, Open Design Alliance ODA Drawings SDK - All Versions \<)
- [CVE-2023-51363](https://cve.now/CVE-2023-51363.md): VR-S1000 firmware Ver. (no CVSS, BUFFALO VR-S1000)
- [CVE-2023-46711](https://cve.now/CVE-2023-46711.md): VR-S1000 firmware Ver. (no CVSS, BUFFALO VR-S1000)
- [CVE-2023-46681](https://cve.now/CVE-2023-46681.md): Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. (no CVSS, BUFFALO VR-S1000)
- [CVE-2023-45741](https://cve.now/CVE-2023-45741.md): VR-S1000 firmware Ver. (no CVSS, BUFFALO VR-S1000)
- [CVE-2023-42436](https://cve.now/CVE-2023-42436.md): Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. (no CVSS, WESEEK GROWI)
- [CVE-2023-50332](https://cve.now/CVE-2023-50332.md): Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. (no CVSS, WESEEK GROWI)
- [CVE-2023-50294](https://cve.now/CVE-2023-50294.md): The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. (no CVSS, WESEEK GROWI)
- [CVE-2023-50175](https://cve.now/CVE-2023-50175.md): Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and th (CVSS 5.4, WESEEK GROWI)
- [CVE-2023-49807](https://cve.now/CVE-2023-49807.md): Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. (no CVSS, WESEEK GROWI)
- [CVE-2023-49779](https://cve.now/CVE-2023-49779.md): Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. (no CVSS, WESEEK GROWI)
- [CVE-2023-49598](https://cve.now/CVE-2023-49598.md): Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. (no CVSS, WESEEK GROWI)
- [CVE-2023-49119](https://cve.now/CVE-2023-49119.md): Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. (no CVSS, WESEEK GROWI)
- [CVE-2023-47215](https://cve.now/CVE-2023-47215.md): Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. (no CVSS, WESEEK GROWI)
- [CVE-2023-46699](https://cve.now/CVE-2023-46699.md): Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. (no CVSS, WESEEK GROWI)
- [CVE-2023-45740](https://cve.now/CVE-2023-45740.md): Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. (CVSS 5.4, WESEEK GROWI)
- [CVE-2023-45737](https://cve.now/CVE-2023-45737.md): Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of G (no CVSS, WESEEK GROWI)
- [CVE-2023-50339](https://cve.now/CVE-2023-50339.md): Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. (no CVSS, WESEEK GROWI)
- [CVE-2023-50297](https://cve.now/CVE-2023-50297.md): Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arb (no CVSS, Alfasado PowerCMS)
- [CVE-2023-49117](https://cve.now/CVE-2023-49117.md): PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. (no CVSS, Alfasado PowerCMS)
- [CVE-2023-51654](https://cve.now/CVE-2023-51654.md): Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. (no CVSS, Brother Industries iPrint&Scan Desktop for Windows)
- [CVE-2023-7111](https://cve.now/CVE-2023-7111.md): code-projects Library Management System index.php sql injection (CVSS 6.3, code-projects Library Management System)
- [CVE-2023-7110](https://cve.now/CVE-2023-7110.md): code-projects Library Management System login.php sql injection (CVSS 7.3, code-projects Library Management System)
- [CVE-2023-7109](https://cve.now/CVE-2023-7109.md): code-projects Library Management System login.php sql injection (CVSS 7.3, code-projects Library Management System)
- [CVE-2023-7108](https://cve.now/CVE-2023-7108.md): code-projects E-Commerce Website user\_signup.php cross site scripting (CVSS 4.3, code-projects E-Commerce Website)
- [CVE-2023-27150](https://cve.now/CVE-2023-27150.md): openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage (no CVSS, org.opencrx:opencrx-core)
- [CVE-2023-28616](https://cve.now/CVE-2023-28616.md): An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. (no CVSS)
- [CVE-2023-48003](https://cve.now/CVE-2023-48003.md): An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims (no CVSS)
- [CVE-2023-49438](https://cve.now/CVE-2023-49438.md): An open redirect vulnerability in the python package Flask-Security-Too \<=5.3.2 allows attackers to redirect unsuspecting users to malicious (no CVSS, flask-security-too)
- [CVE-2023-49949](https://cve.now/CVE-2023-49949.md): Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes. (no CVSS)
- [CVE-2023-51090](https://cve.now/CVE-2023-51090.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig. (no CVSS)
- [CVE-2023-51091](https://cve.now/CVE-2023-51091.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler. (no CVSS)
- [CVE-2023-51092](https://cve.now/CVE-2023-51092.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade. (CVSS 8.8)
- [CVE-2023-51093](https://cve.now/CVE-2023-51093.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo. (no CVSS)
- [CVE-2023-51094](https://cve.now/CVE-2023-51094.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet. (no CVSS)
- [CVE-2023-51095](https://cve.now/CVE-2023-51095.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy. (no CVSS)
- [CVE-2023-51097](https://cve.now/CVE-2023-51097.md): Tenda W9 V1.0.0.7(4456)\_CN was discovered to contain a stack overflow via the function formSetAutoPing. (no CVSS)
- [CVE-2023-51098](https://cve.now/CVE-2023-51098.md): Tenda W9 V1.0.0.7(4456)\_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo . (no CVSS)
- [CVE-2023-51099](https://cve.now/CVE-2023-51099.md): Tenda W9 V1.0.0.7(4456)\_CN was discovered to contain a command injection vulnerability via the function formexeCommand . (no CVSS)
- [CVE-2023-51100](https://cve.now/CVE-2023-51100.md): Tenda W9 V1.0.0.7(4456)\_CN was discovered to contain a command injection vulnerability via the function formGetDiagnoseInfo . (no CVSS)
- [CVE-2023-51101](https://cve.now/CVE-2023-51101.md): Tenda W9 V1.0.0.7(4456)\_CN was discovered to contain a stack overflow via the function formSetUplinkInfo. (CVSS 9.8)
- [CVE-2023-51102](https://cve.now/CVE-2023-51102.md): Tenda W9 V1.0.0.7(4456)\_CN was discovered to contain a stack overflow via the function formWifiMacFilterSet. (no CVSS)
- [CVE-2023-51103](https://cve.now/CVE-2023-51103.md): A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz\_new\_pixmap\_from\_float\_da (no CVSS)
- [CVE-2023-51104](https://cve.now/CVE-2023-51104.md): A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm\_binary\_read\_image() of load (CVSS 7.5)
- [CVE-2023-51105](https://cve.now/CVE-2023-51105.md): A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmp\_decompress\_rle4() of load-b (no CVSS)
- [CVE-2023-51106](https://cve.now/CVE-2023-51106.md): A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function pnm\_binary\_read\_image() of load-pnm.c w (no CVSS)
- [CVE-2023-51107](https://cve.now/CVE-2023-51107.md): A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute\_color() of jquant2.c. (CVSS 7.5)
- [CVE-2023-52086](https://cve.now/CVE-2023-52086.md): resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in mul (no CVSS)
- [CVE-2023-52096](https://cve.now/CVE-2023-52096.md): SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an applic (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.