# CVEs published 2023-12-28

74 CVEs were published on December 28, 2023: 3 critical, 25 high. Days are UTC.

- [CVE-2023-7141](https://cve.now/CVE-2023-7141.md): code-projects Client Details System update-clients.php sql injection (CVSS 4.3, code-projects Client Details System)
- [CVE-2023-7140](https://cve.now/CVE-2023-7140.md): code-projects Client Details System manage-users.php sql injection (CVSS 4.3, code-projects Client Details System)
- [CVE-2023-7139](https://cve.now/CVE-2023-7139.md): code-projects Client Details System HTTP POST Request regester.php sql injection (CVSS 4.3, code-projects Client Details System)
- [CVE-2023-52084](https://cve.now/CVE-2023-52084.md): Winter CMS Stored XSS through Backend ColorPicker FormWidget (CVSS 2.0, wintercms winter · winter/wn-backend-module)
- [CVE-2023-52083](https://cve.now/CVE-2023-52083.md): Stored XSS through privileged upload of Media Manager file followed by renaming (CVSS 2.0, wintercms winter · winter/wn-system-module)
- [CVE-2023-7138](https://cve.now/CVE-2023-7138.md): code-projects Client Details System HTTP POST Request admin sql injection (CVSS 6.3, code-projects Client Details System)
- [CVE-2022-36399](https://cve.now/CVE-2022-36399.md): WordPress Booked Plugin \< 2.4.4 is vulnerable to Sensitive Data Exposure (CVSS 5.3, BoxyStudio Booked - Appointment Booking for WordPress | Cal…)
- [CVE-2023-7137](https://cve.now/CVE-2023-7137.md): code-projects Client Details System HTTP POST Request sql injection (CVSS 6.3, code-projects Client Details System)
- [CVE-2023-7136](https://cve.now/CVE-2023-7136.md): code-projects Record Management System Document Type doctype.php cross site scripting (CVSS 2.4, code-projects Record Management System)
- [CVE-2023-7135](https://cve.now/CVE-2023-7135.md): code-projects Record Management System Offices offices.php cross site scripting (CVSS 2.4, code-projects Record Management System)
- [CVE-2023-50838](https://cve.now/CVE-2023-50838.md): WordPress NEX-Forms – Ultimate Form Builder Plugin \<= 8.5.5 is vulnerable to SQL Injection (CVSS 7.6, Basix NEX-Forms – Ultimate Form Builder – Contact forms and…)
- [CVE-2023-50839](https://cve.now/CVE-2023-50839.md): WordPress JS Help Desk – Best Help Desk & Support Plugin \<= 2.8.1 is vulnerable to SQL Injection (CVSS 9.3, JS Help Desk – Best Help Desk & Support Plugin)
- [CVE-2023-7134](https://cve.now/CVE-2023-7134.md): SourceCodester Medicine Tracking System path traversal (CVSS 6.3, SourceCodester Medicine Tracking System)
- [CVE-2023-50840](https://cve.now/CVE-2023-50840.md): WordPress Booking Manager Plugin \<= 2.1.5 is vulnerable to SQL Injection (CVSS 8.5, wpdevelop, oplugins Booking Manager)
- [CVE-2023-50841](https://cve.now/CVE-2023-50841.md): WordPress BookingPress Plugin \<= 1.0.72 is vulnerable to SQL Injection (CVSS 8.5, Repute Infosystems BookingPress – Appointment Booking Calen…)
- [CVE-2023-50842](https://cve.now/CVE-2023-50842.md): WordPress MF Gig Calendar Plugin \<= 1.2.1 is vulnerable to SQL Injection (CVSS 8.5, Matthew Fries MF Gig Calendar)
- [CVE-2023-50843](https://cve.now/CVE-2023-50843.md): WordPress Clockwork SMS Notfications Plugin \<= 3.0.4 is vulnerable to SQL Injection (CVSS 7.6, Clockwork SMS Notfications)
- [CVE-2023-50844](https://cve.now/CVE-2023-50844.md): WordPress WP Mail Catcher Plugin \<= 2.1.3 is vulnerable to SQL Injection (CVSS 7.6, James Ward Mail logging – WP Mail Catcher)
- [CVE-2023-50845](https://cve.now/CVE-2023-50845.md): WordPress GeoDirectory Plugin \<= 2.3.28 is vulnerable to SQL Injection (CVSS 7.6, AyeCode - WordPress Business Directory Plugins GeoDirectory…)
- [CVE-2023-50846](https://cve.now/CVE-2023-50846.md): WordPress RegistrationMagic Plugin \<= 5.2.4.5 is vulnerable to SQL Injection (CVSS 7.6, RegistrationMagic – Custom Registration Forms, User Registr…)
- [CVE-2023-50847](https://cve.now/CVE-2023-50847.md): WordPress Welcart e-Commerce Plugin \<= 2.9.3 is vulnerable to SQL Injection (CVSS 7.6, Collne Welcart e-Commerce)
- [CVE-2023-7133](https://cve.now/CVE-2023-7133.md): y\_project RuoYi HTTP POST Request login cross site scripting (CVSS 4.3, y\_project RuoYi)
- [CVE-2023-7132](https://cve.now/CVE-2023-7132.md): code-projects Intern Membership Management System User Registration cross site scripting (CVSS 3.5, code-projects Intern Membership Management System)
- [CVE-2023-7131](https://cve.now/CVE-2023-7131.md): code-projects Intern Membership Management System User Registration sql injection (CVSS 6.3, code-projects Intern Membership Management System)
- [CVE-2023-52082](https://cve.now/CVE-2023-52082.md): Lychee is vulnerable to an SQL Injection in explain DB queries. (CVSS 8.8, LycheeOrg Lychee)
- [CVE-2023-7163](https://cve.now/CVE-2023-7163.md): D-Link D-View 8 Unauthenticated Probe-Core Server Communication (CVSS 10.0, D-Link D-View)
- [CVE-2023-52081](https://cve.now/CVE-2023-52081.md): ewen-lbh/ffcss late-Unicode normalization vulnerability (CVSS 5.3, ewen-lbh ffcss · github.com/ewen-lbh/ffcss)
- [CVE-2023-7129](https://cve.now/CVE-2023-7129.md): code-projects Voting System Voters Login sql injection (CVSS 5.5, code-projects Voting System)
- [CVE-2023-52079](https://cve.now/CVE-2023-52079.md): Conversion of property names to strings can trigger infinite recursion (CVSS 6.8, kriszyp msgpackr · msgpackr)
- [CVE-2023-50267](https://cve.now/CVE-2023-50267.md): MeterSphere horizontal privilege escalation vulnerability of resources in project scope. (CVSS 4.3, metersphere)
- [CVE-2023-7128](https://cve.now/CVE-2023-7128.md): code-projects Voting System Admin Login sql injection (CVSS 6.3, code-projects Voting System)
- [CVE-2023-7127](https://cve.now/CVE-2023-7127.md): code-projects Automated Voting System Login sql injection (CVSS 6.3, code-projects Automated Voting System)
- [CVE-2023-7126](https://cve.now/CVE-2023-7126.md): code-projects Automated Voting System Admin Login sql injection (CVSS 6.3, code-projects Automated Voting System)
- [CVE-2023-50848](https://cve.now/CVE-2023-50848.md): WordPress 404 Solution Plugin \<= 2.34.0 is vulnerable to SQL Injection (CVSS 7.6, Aaron J 404 Solution)
- [CVE-2023-50849](https://cve.now/CVE-2023-50849.md): WordPress e2pdf Plugin \<= 1.20.23 is vulnerable to SQL Injection (CVSS 7.6, E2Pdf.com E2Pdf – Export To Pdf Tool for WordPress)
- [CVE-2023-50852](https://cve.now/CVE-2023-50852.md): WordPress BookIt Plugin \<= 2.4.3 is vulnerable to SQL Injection (CVSS 7.6, StylemixThemes Booking Calendar | Appointment Booking | Boo…)
- [CVE-2023-50851](https://cve.now/CVE-2023-50851.md): WordPress Simply Schedule Appointments Plugin \< 1.6.6.1 is vulnerable to SQL Injection (CVSS 7.6, N Squared Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2023-50853](https://cve.now/CVE-2023-50853.md): WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin \<= 1.75.0 is vulnerable to SQL Injection (CVSS 7.6, Nasirahmed Advanced Form Integration – Connect WooCommerce…)
- [CVE-2023-50854](https://cve.now/CVE-2023-50854.md): WordPress Squirrly SEO - Advanced Pack Plugin \<= 2.3.8 is vulnerable to SQL Injection (CVSS 7.6, Squirrly SEO - Advanced Pack)
- [CVE-2023-50855](https://cve.now/CVE-2023-50855.md): WordPress Pre\* Party Resource Hints Plugin \<= 1.8.18 is vulnerable to SQL Injection (CVSS 7.6, Sam Perrow Pre\* Party Resource Hints)
- [CVE-2023-50856](https://cve.now/CVE-2023-50856.md): WordPress Funnel Builder for WordPress by FunnelKit Plugin \<= 2.14.3 is vulnerable to SQL Injection (CVSS 7.6, Funnel Builder for WordPress by FunnelKit – Customize WooCo…)
- [CVE-2023-50857](https://cve.now/CVE-2023-50857.md): WordPress Automation By Autonami Plugin \<= 2.6.1 is vulnerable to SQL Injection (CVSS 7.6, Recover WooCommerce Cart Abandonment, Newsletter, Email Mar…)
- [CVE-2023-27447](https://cve.now/CVE-2023-27447.md): WordPress WP SMS Plugin \<= 6.0.4 is vulnerable to Sensitive Data Exposure (CVSS 5.3, VeronaLabs WP SMS – Messaging & SMS Notification for WordPr…)
- [CVE-2023-32513](https://cve.now/CVE-2023-32513.md): WordPress GiveWP Plugin \<= 2.25.3 is vulnerable to PHP Object Injection (CVSS 7.5, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2023-32795](https://cve.now/CVE-2023-32795.md): WordPress WooCommerce Product Add-ons Plugin \<= 6.1.3 is vulnerable to PHP Object Injection (CVSS 8.2, WooCommerce Product Add-Ons)
- [CVE-2023-36381](https://cve.now/CVE-2023-36381.md): WordPress Zippy Plugin \<= 1.6.5 is vulnerable to PHP Object Injection (CVSS 6.6, Gesundheit Bewegt Zippy)
- [CVE-2023-50858](https://cve.now/CVE-2023-50858.md): WordPress Anti Hacker Plugin \<= 4.34 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Ping…)
- [CVE-2023-50873](https://cve.now/CVE-2023-50873.md): WordPress Add Any Extension to Pages Plugin \<= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Marios Alexandrou Add Any Extension to Pages)
- [CVE-2023-50836](https://cve.now/CVE-2023-50836.md): WordPress HTML Forms Plugin \<= 1.3.28 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, ibericode HTML Forms)
- [CVE-2023-50859](https://cve.now/CVE-2023-50859.md): WordPress WP Crowdfunding Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Themeum WP Crowdfunding)
- [CVE-2023-50860](https://cve.now/CVE-2023-50860.md): WordPress Amelia Plugin \<= 1.0.85 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, TMS Booking for Appointments and Events Calendar – Amelia)
- [CVE-2023-50874](https://cve.now/CVE-2023-50874.md): WordPress Ajax Load More Plugin \<= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Darren Cooney WordPress Infinite Scroll – Ajax Load More)
- [CVE-2023-51501](https://cve.now/CVE-2023-51501.md): WordPress Uncode Core Plugin \<= 2.8.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Undsgn Uncode - Creative & WooCommerce WordPress Theme)
- [CVE-2023-4672](https://cve.now/CVE-2023-4672.md): XSS in Talent Soft's ECOP (CVSS 6.1, Talent Software ECOP)
- [CVE-2023-4671](https://cve.now/CVE-2023-4671.md): SQLi in Talent Soft's ECOP (CVSS 9.8, Talent Software ECOP)
- [CVE-2023-45702](https://cve.now/CVE-2023-45702.md): HCL Launch Agent as a Windows service is vulnerable to a Denial of Service (CVSS 6.2, HCL Software HCL Launch)
- [CVE-2023-45701](https://cve.now/CVE-2023-45701.md): HCL Launch is susceptible to sensitive information disclosure (CVSS 4.3, HCL Software HCL Launch)
- [CVE-2023-7124](https://cve.now/CVE-2023-7124.md): code-projects E-Commerce Site search.php cross site scripting (CVSS 4.3, code-projects E-Commerce Site)
- [CVE-2023-34829](https://cve.now/CVE-2023-34829.md): Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext. (CVSS 6.5)
- [CVE-2023-46987](https://cve.now/CVE-2023-46987.md): SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php. (no CVSS)
- [CVE-2023-46989](https://cve.now/CVE-2023-46989.md): SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrar (no CVSS)
- [CVE-2023-49228](https://cve.now/CVE-2023-49228.md): An issue was discovered in Peplink Balance Two before 8.4.0. (no CVSS)
- [CVE-2023-49229](https://cve.now/CVE-2023-49229.md): An issue was discovered in Peplink Balance Two before 8.4.0. (no CVSS)
- [CVE-2023-49230](https://cve.now/CVE-2023-49230.md): An issue was discovered in Peplink Balance Two before 8.4.0. (no CVSS)
- [CVE-2023-49469](https://cve.now/CVE-2023-49469.md): Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag func (no CVSS)
- [CVE-2023-50038](https://cve.now/CVE-2023-50038.md): There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. (no CVSS)
- [CVE-2023-50104](https://cve.now/CVE-2023-50104.md): ZZCMS 2023 has a file upload vulnerability in 3/E\_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privil (no CVSS)
- [CVE-2023-50445](https://cve.now/CVE-2023-50445.md): Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3. (CVSS 7.8)
- [CVE-2023-50448](https://cve.now/CVE-2023-50448.md): In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belon (no CVSS, activeadmin)
- [CVE-2023-50470](https://cve.now/CVE-2023-50470.md): A cross-site scripting (XSS) vulnerability in the component admin\_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scrip (no CVSS)
- [CVE-2023-50692](https://cve.now/CVE-2023-50692.md): File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to (CVSS 8.8)
- [CVE-2023-51006](https://cve.now/CVE-2023-51006.md): An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors. (no CVSS)
- [CVE-2023-51010](https://cve.now/CVE-2023-51010.md): An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering (no CVSS)
- [CVE-2023-52152](https://cve.now/CVE-2023-52152.md): mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalcul (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.