CVEs published December 28, 2023
74 CVEs were published on December 28, 2023: 3 critical, 25 high.
- Published
- 74
- Critical
- 3
- High
- 25
- Medium
- 29
- Low
- 5
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- code-projects Client Details System
- 5
- code-projects Automated Voting System
- 2
- code-projects Intern Membership Management System
- 2
- code-projects Record Management System
- 2
- code-projects Voting System
- 2
- HCL Software HCL Launch
- 2
- Talent Software ECOP
- 2
- Aaron J 404 Solution
- 1
- activeadmin
- 1
- AyeCode - WordPress Business Directory Plugins GeoDirectory…
- 1
Critical 3
- CVE-2023-50839WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL InjectionJS Help Desk – Best Help Desk & Support Plugin
- CVE-2023-7163D-Link D-View 8 Unauthenticated Probe-Core Server CommunicationD-Link D-View
- CVE-2023-4671SQLi in Talent Soft's ECOPTalent Software ECOP
High 25
- CVE-2023-50838WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.5 is vulnerable to SQL InjectionBasix NEX-Forms – Ultimate Form Builder – Contact forms and…
- CVE-2023-50840WordPress Booking Manager Plugin <= 2.1.5 is vulnerable to SQL Injectionwpdevelop, oplugins Booking Manager
- CVE-2023-50841WordPress BookingPress Plugin <= 1.0.72 is vulnerable to SQL InjectionRepute Infosystems BookingPress – Appointment Booking Calen…
- CVE-2023-50842WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to SQL InjectionMatthew Fries MF Gig Calendar
- CVE-2023-50843WordPress Clockwork SMS Notfications Plugin <= 3.0.4 is vulnerable to SQL InjectionClockwork SMS Notfications
- CVE-2023-50844WordPress WP Mail Catcher Plugin <= 2.1.3 is vulnerable to SQL InjectionJames Ward Mail logging – WP Mail Catcher
- CVE-2023-50845WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL InjectionAyeCode - WordPress Business Directory Plugins GeoDirectory…
- CVE-2023-50846WordPress RegistrationMagic Plugin <= 5.2.4.5 is vulnerable to SQL InjectionRegistrationMagic – Custom Registration Forms, User Registr…
- CVE-2023-50847WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL InjectionCollne Welcart e-Commerce
- CVE-2023-52082Lychee is vulnerable to an SQL Injection in explain DB queries.LycheeOrg Lychee
- CVE-2023-50848WordPress 404 Solution Plugin <= 2.34.0 is vulnerable to SQL InjectionAaron J 404 Solution
- CVE-2023-50849WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL InjectionE2Pdf.com E2Pdf – Export To Pdf Tool for WordPress
- CVE-2023-50852WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL InjectionStylemixThemes Booking Calendar | Appointment Booking | Boo…
- CVE-2023-50851WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL InjectionN Squared Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2023-50853WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL InjectionNasirahmed Advanced Form Integration – Connect WooCommerce…
- CVE-2023-50854WordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL InjectionSquirrly SEO - Advanced Pack
- CVE-2023-50855WordPress Pre* Party Resource Hints Plugin <= 1.8.18 is vulnerable to SQL InjectionSam Perrow Pre* Party Resource Hints
- CVE-2023-50856WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL InjectionFunnel Builder for WordPress by FunnelKit – Customize WooCo…
- CVE-2023-50857WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL InjectionRecover WooCommerce Cart Abandonment, Newsletter, Email Mar…
- CVE-2023-32513WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object InjectionGiveWP – Donation Plugin and Fundraising Platform
- CVE-2023-32795WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object InjectionWooCommerce Product Add-Ons
- CVE-2023-51501WordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)Undsgn Uncode - Creative & WooCommerce WordPress Theme
- CVE-2023-50445Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.
- CVE-2023-50692File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to
- CVE-2023-52152mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalcul
Medium, low and unrated 46
- CVE-2023-7141code-projects Client Details System update-clients.php sql injectioncode-projects Client Details System
- CVE-2023-7140code-projects Client Details System manage-users.php sql injectioncode-projects Client Details System
- CVE-2023-7139code-projects Client Details System HTTP POST Request regester.php sql injectioncode-projects Client Details System
- CVE-2023-52084Winter CMS Stored XSS through Backend ColorPicker FormWidgetwintercms winter · winter/wn-backend-module
- CVE-2023-52083Stored XSS through privileged upload of Media Manager file followed by renamingwintercms winter · winter/wn-system-module
- CVE-2023-7138code-projects Client Details System HTTP POST Request admin sql injectioncode-projects Client Details System
- CVE-2022-36399WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data ExposureBoxyStudio Booked - Appointment Booking for WordPress | Cal…
- CVE-2023-7137code-projects Client Details System HTTP POST Request sql injectioncode-projects Client Details System
- CVE-2023-7136code-projects Record Management System Document Type doctype.php cross site scriptingcode-projects Record Management System
- CVE-2023-7135code-projects Record Management System Offices offices.php cross site scriptingcode-projects Record Management System
- CVE-2023-7134SourceCodester Medicine Tracking System path traversalSourceCodester Medicine Tracking System
- CVE-2023-7133y_project RuoYi HTTP POST Request login cross site scriptingy_project RuoYi
- CVE-2023-7132code-projects Intern Membership Management System User Registration cross site scriptingcode-projects Intern Membership Management System
- CVE-2023-7131code-projects Intern Membership Management System User Registration sql injectioncode-projects Intern Membership Management System
- CVE-2023-52081ewen-lbh/ffcss late-Unicode normalization vulnerabilityewen-lbh ffcss · github.com/ewen-lbh/ffcss
- CVE-2023-7129code-projects Voting System Voters Login sql injectioncode-projects Voting System
- CVE-2023-52079Conversion of property names to strings can trigger infinite recursionkriszyp msgpackr · msgpackr
- CVE-2023-50267MeterSphere horizontal privilege escalation vulnerability of resources in project scope.metersphere
- CVE-2023-7128code-projects Voting System Admin Login sql injectioncode-projects Voting System
- CVE-2023-7127code-projects Automated Voting System Login sql injectioncode-projects Automated Voting System
- CVE-2023-7126code-projects Automated Voting System Admin Login sql injectioncode-projects Automated Voting System
- CVE-2023-27447WordPress WP SMS Plugin <= 6.0.4 is vulnerable to Sensitive Data ExposureVeronaLabs WP SMS – Messaging & SMS Notification for WordPr…
- CVE-2023-36381WordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object InjectionGesundheit Bewegt Zippy
- CVE-2023-50858WordPress Anti Hacker Plugin <= 4.34 is vulnerable to Cross Site Request Forgery (CSRF)Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Ping…
- CVE-2023-50873WordPress Add Any Extension to Pages Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)Marios Alexandrou Add Any Extension to Pages
- CVE-2023-50836WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)ibericode HTML Forms
- CVE-2023-50859WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)Themeum WP Crowdfunding
- CVE-2023-50860WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)TMS Booking for Appointments and Events Calendar – Amelia
- CVE-2023-50874WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)Darren Cooney WordPress Infinite Scroll – Ajax Load More
- CVE-2023-4672XSS in Talent Soft's ECOPTalent Software ECOP
- CVE-2023-45702HCL Launch Agent as a Windows service is vulnerable to a Denial of ServiceHCL Software HCL Launch
- CVE-2023-45701HCL Launch is susceptible to sensitive information disclosureHCL Software HCL Launch
- CVE-2023-7124code-projects E-Commerce Site search.php cross site scriptingcode-projects E-Commerce Site
- CVE-2023-34829Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.
- CVE-2023-46987SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.
- CVE-2023-46989SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrar
- CVE-2023-49228An issue was discovered in Peplink Balance Two before 8.4.0.
- CVE-2023-49229An issue was discovered in Peplink Balance Two before 8.4.0.
- CVE-2023-49230An issue was discovered in Peplink Balance Two before 8.4.0.
- CVE-2023-49469Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag func
- CVE-2023-50038There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.
- CVE-2023-50104ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privil
- CVE-2023-50448In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belonactiveadmin
- CVE-2023-50470A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scrip
- CVE-2023-51006An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors.
- CVE-2023-51010An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering