# CVEs published 2023-12-29

160 CVEs were published on December 29, 2023: 26 critical, 25 high. Days are UTC.

- [CVE-2023-7171](https://cve.now/CVE-2023-7171.md): Novel-Plus Friendly Link FriendLinkController.java cross site scripting (CVSS 2.4, Novel-Plus)
- [CVE-2023-52139](https://cve.now/CVE-2023-52139.md): Misskey vulnerable to improper authorization when accessing with third-party application (CVSS 9.1, misskey-dev misskey)
- [CVE-2023-52137](https://cve.now/CVE-2023-52137.md): GitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames (CVSS 7.7, tj-actions verify-changed-files)
- [CVE-2023-51663](https://cve.now/CVE-2023-51663.md): Hail authentication can be bypassed by changing email address (CVSS 5.3, hail-is hail · hail)
- [CVE-2020-17163](https://cve.now/CVE-2020-17163.md): Visual Studio Code Python Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Python extension for Visual Studio Code)
- [CVE-2023-51527](https://cve.now/CVE-2023-51527.md): WordPress GPT3 AI Content Writer Plugin \<= 1.8.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4)
- [CVE-2023-51688](https://cve.now/CVE-2023-51688.md): WordPress eCommerce Product Catalog Plugin \<= 3.3.26 is vulnerable to Sensitive Data Exposure (CVSS 5.3, impleCode eCommerce Product Catalog Plugin for WordPress)
- [CVE-2023-51687](https://cve.now/CVE-2023-51687.md): WordPress Product Catalog Simple Plugin \<= 1.7.6 is vulnerable to Sensitive Data Exposure (CVSS 5.3, impleCode Product Catalog Simple)
- [CVE-2023-51517](https://cve.now/CVE-2023-51517.md): WordPress Calculated Fields Form Plugin \<= 1.2.28 is vulnerable to Open Redirection (CVSS 4.1, CodePeople Calculated Fields Form)
- [CVE-2023-4675](https://cve.now/CVE-2023-4675.md): SQLi i GM Informatics MDO (CVSS 9.8, GM Information Technologies MDO)
- [CVE-2023-4674](https://cve.now/CVE-2023-4674.md): SQLi in Yazteks E-Commerce Software (no CVSS, Yaztek Software Technologies and Computer Systems E-Commerc…)
- [CVE-2023-4541](https://cve.now/CVE-2023-4541.md): SQLi in Weens Admin Panel (CVSS 9.8, Ween Software Admin Panel)
- [CVE-2023-47804](https://cve.now/CVE-2023-47804.md): Apache OpenOffice: Macro URL arbitrary script execution (no CVSS, Apache Software Foundation Apache OpenOffice)
- [CVE-2023-51675](https://cve.now/CVE-2023-51675.md): WordPress Advanced Access Manager Plugin \<= 6.9.18 is vulnerable to Open Redirection (CVSS 4.7, AAM Advanced Access Manager – Restricted Content, Users & R…)
- [CVE-2023-51410](https://cve.now/CVE-2023-51410.md): WordPress WP Mail Log Plugin \<= 1.1.2 is vulnerable to Arbitrary File Upload (CVSS 9.9, WPVibes WP Mail Log)
- [CVE-2023-51411](https://cve.now/CVE-2023-51411.md): WordPress Frontend Admin by DynamiApps Plugin \<= 3.18.3 is vulnerable to Arbitrary File Upload (CVSS 10.0, Shabti Kaplan Frontend Admin by DynamiApps)
- [CVE-2023-51412](https://cve.now/CVE-2023-51412.md): WordPress Piotnet Forms Plugin \<= 1.0.25 is vulnerable to Arbitrary File Upload (CVSS 9.0, Piotnet Forms)
- [CVE-2023-51417](https://cve.now/CVE-2023-51417.md): WordPress JVM rich text icons Plugin \<= 1.2.3 is vulnerable to Arbitrary File Upload (CVSS 9.9, Joris van Montfort JVM Gutenberg Rich Text Icons)
- [CVE-2023-51419](https://cve.now/CVE-2023-51419.md): WordPress BERTHA AI Plugin \<= 1.11.10.7 is vulnerable to Arbitrary File Upload (CVSS 10.0, Bertha.ai BERTHA AI. Your AI co-pilot for WordPress and Chr…)
- [CVE-2023-51421](https://cve.now/CVE-2023-51421.md): WordPress Verge3D Plugin \<= 4.5.2 is vulnerable to Arbitrary File Upload (CVSS 9.9, Soft8Soft Verge3D Publishing and E-Commerce)
- [CVE-2023-51468](https://cve.now/CVE-2023-51468.md): WordPress Rencontre – Dating Site Plugin \<= 3.10.1 is vulnerable to Arbitrary File Upload (CVSS 10.0, Jacques Malgrange Rencontre – Dating Site)
- [CVE-2023-51473](https://cve.now/CVE-2023-51473.md): WordPress TerraClassifieds Plugin \<= 2.0.3 is vulnerable to Arbitrary File Upload (CVSS 10.0, Pixelemu TerraClassifieds – Simple Classifieds Plugin)
- [CVE-2023-51475](https://cve.now/CVE-2023-51475.md): WordPress WP MLM Unilevel Plugin \<= 4.0 is vulnerable to Arbitrary File Upload (CVSS 10.0, IOSS WP MLM SOFTWARE PLUGIN)
- [CVE-2023-51414](https://cve.now/CVE-2023-51414.md): WordPress EnvíaloSimple Plugin \<= 2.1 is vulnerable to PHP Object Injection (CVSS 9.6, EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters)
- [CVE-2023-51422](https://cve.now/CVE-2023-51422.md): WordPress WebinarIgnition Plugin \<= 3.05.0 is vulnerable to PHP Object Injection (CVSS 9.9, Saleswonder Team Webinar Plugin: Create live/evergreen/auto…)
- [CVE-2023-51470](https://cve.now/CVE-2023-51470.md): WordPress Rencontre – Dating Site Plugin \<= 3.11.1 is vulnerable to PHP Object Injection (CVSS 9.9, Jacques Malgrange Rencontre – Dating Site)
- [CVE-2023-51505](https://cve.now/CVE-2023-51505.md): WordPress Active Products Tables for WooCommerce Plugin \<= 1.0.6 is vulnerable to PHP Object Injection (CVSS 10.0, realmag777 Active Products Tables for WooCommerce. Professi…)
- [CVE-2023-51545](https://cve.now/CVE-2023-51545.md): WordPress Job Manager & Career Plugin \<= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection (CVSS 9.6, ThemeHigh Job Manager & Career – Manage job board listings,…)
- [CVE-2023-7114](https://cve.now/CVE-2023-7114.md): Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server. (CVSS 7.1, Mattermost)
- [CVE-2023-7113](https://cve.now/CVE-2023-7113.md): Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web c (CVSS 3.7, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2023-51676](https://cve.now/CVE-2023-51676.md): WordPress Happy Addons for Elementor Plugin \<= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.9, Leevio Happy Addons for Elementor)
- [CVE-2023-50878](https://cve.now/CVE-2023-50878.md): WordPress MStore API Plugin \<= 4.10.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, InspireUI MStore API)
- [CVE-2023-50902](https://cve.now/CVE-2023-50902.md): WordPress New User Approve Plugin \<= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WPExpertsio New User Approve)
- [CVE-2023-51354](https://cve.now/CVE-2023-51354.md): WordPress Webba Booking Plugin \<= 4.5.33 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WebbaPlugins Appointment & Event Booking Calendar Plugin –…)
- [CVE-2023-51358](https://cve.now/CVE-2023-51358.md): WordPress Block IPs for Gravity Forms Plugin \<= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Bright Plugins Block IPs for Gravity Forms)
- [CVE-2023-51378](https://cve.now/CVE-2023-51378.md): WordPress Rise Blocks Plugin \<= 3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Rise Themes Rise Blocks – A Complete Gutenberg Page Builder)
- [CVE-2023-51402](https://cve.now/CVE-2023-51402.md): WordPress Ultimate Addons for WPBakery Page Builder Plugin \<= 3.19.17 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Brain Storm Force Ultimate Addons for WPBakery Page Builder)
- [CVE-2023-7080](https://cve.now/CVE-2023-7080.md): Arbitrary remote code execution within wrangler dev Workers sandbox (CVSS 8.5, Cloudflare wrangler · wrangler)
- [CVE-2023-7079](https://cve.now/CVE-2023-7079.md): Arbitrary remote file read in Wrangler dev server (CVSS 6.4, Cloudflare wrangler · wrangler)
- [CVE-2023-7078](https://cve.now/CVE-2023-7078.md): Server-Side Request Forgery (SSRF) in Miniflare (CVSS 7.5, Cloudflare miniflare · miniflare)
- [CVE-2023-44089](https://cve.now/CVE-2023-44089.md): XSS in Visual Console (CVSS 6.1, Pandora FMS)
- [CVE-2023-44088](https://cve.now/CVE-2023-44088.md): SQL Injection in Visual Console (CVSS 5.9, Pandora FMS)
- [CVE-2023-41815](https://cve.now/CVE-2023-41815.md): XSS in File manager (CVSS 7.5, Pandora FMS)
- [CVE-2023-41814](https://cve.now/CVE-2023-41814.md): XSS Vulnerability Messages (CVSS 3.7, Pandora FMS)
- [CVE-2023-50837](https://cve.now/CVE-2023-50837.md): WordPress Login Lockdown Plugin \<= 2.06 is vulnerable to SQL Injection (CVSS 7.6, WebFactory Login Lockdown – Protect Login Form)
- [CVE-2023-41813](https://cve.now/CVE-2023-41813.md): User notification settings edition (CVSS 3.0, Pandora FMS)
- [CVE-2023-50879](https://cve.now/CVE-2023-50879.md): WordPress WordPress.com Editing Toolkit Plugin \<= 3.78784 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Automattic WordPress.com Editing Toolkit)
- [CVE-2023-50880](https://cve.now/CVE-2023-50880.md): WordPress BuddyPress Plugin \<= 11.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, The BuddyPress Community BuddyPress)
- [CVE-2023-50881](https://cve.now/CVE-2023-50881.md): WordPress Advanced Access Manager Plugin \<= 6.9.15 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, AAM Advanced Access Manager – Restricted Content, Users & R…)
- [CVE-2023-50889](https://cve.now/CVE-2023-50889.md): WordPress Beaver Builder Plugin \<= 2.7.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, The Beaver Builder Team Beaver Builder – WordPress Page Bui…)
- [CVE-2023-50891](https://cve.now/CVE-2023-50891.md): WordPress Zoho Forms Plugin \<= 3.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Form plugin for WordPress – Zoho Forms)
- [CVE-2023-50892](https://cve.now/CVE-2023-50892.md): WordPress TheGem Theme \<= 5.9.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, CodexThemes TheGem - Creative Multi-Purpose & WooCommerce W…)
- [CVE-2023-50893](https://cve.now/CVE-2023-50893.md): WordPress UpSolution Core Plugin \<= 8.17.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, UpSolution Impreza – WordPress Website and WooCommerce Buil…)
- [CVE-2023-50896](https://cve.now/CVE-2023-50896.md): WordPress weForms Plugin \<= 1.6.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, weForms – Easy Drag & Drop Contact Form Builder For WordPre…)
- [CVE-2023-50901](https://cve.now/CVE-2023-50901.md): WordPress HT Mega Plugin \<= 2.3.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, HasThemes HT Mega – Absolute Addons For Elementor)
- [CVE-2023-51361](https://cve.now/CVE-2023-51361.md): WordPress Sticky Chat Widget Plugin \<= 1.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Emai…)
- [CVE-2023-51371](https://cve.now/CVE-2023-51371.md): WordPress Bit Assist Plugin \<= 1.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger C…)
- [CVE-2023-51373](https://cve.now/CVE-2023-51373.md): WordPress Google Photos Gallery with Shortcodes Plugin \<= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Ian Kennerley Google Photos Gallery with Shortcodes)
- [CVE-2023-51372](https://cve.now/CVE-2023-51372.md): WordPress HashBar – WordPress Notification Bar Plugin \<= 1.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, HasThemes HashBar – WordPress Notification Bar)
- [CVE-2023-51374](https://cve.now/CVE-2023-51374.md): WordPress ZeroBounce Email Verification & Validation Plugin \<= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, ZeroBounce Email Verification & Validation)
- [CVE-2023-51396](https://cve.now/CVE-2023-51396.md): WordPress Brizy – Page Builder Plugin \<= 2.4.29 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Brizy.io Brizy – Page Builder)
- [CVE-2023-51397](https://cve.now/CVE-2023-51397.md): WordPress WP Remote Site Search Plugin \<= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Brainstorm Force WP Remote Site Search)
- [CVE-2023-51399](https://cve.now/CVE-2023-51399.md): WordPress Back Button Widget Plugin \<= 1.6.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WPFactory Back Button Widget)
- [CVE-2023-51541](https://cve.now/CVE-2023-51541.md): WordPress Stock Ticker Plugin \<= 3.23.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Aleksandar Urošević Stock Ticker)
- [CVE-2023-52135](https://cve.now/CVE-2023-52135.md): WordPress WS Form LITE Plugin \<= 1.9.170 is vulnerable to SQL Injection (CVSS 7.6, WS Form LITE – Drag & Drop Contact Form Builder for WordPre…)
- [CVE-2023-32517](https://cve.now/CVE-2023-32517.md): WordPress MailChimp Subscribe Forms Plugin \<= 4.0.9.3 is vulnerable to Open Redirection (CVSS 4.7, PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Bu…)
- [CVE-2023-32101](https://cve.now/CVE-2023-32101.md): WordPress Library Viewer Plugin \<= 2.0.6 is vulnerable to Open Redirection (CVSS 4.7, Pexle Chris Library Viewer)
- [CVE-2023-31237](https://cve.now/CVE-2023-31237.md): WordPress Zephyr Project Manager Plugin \<= 3.3.9 is vulnerable to Open Redirection (CVSS 4.7, Dylan James Zephyr Project Manager)
- [CVE-2023-31229](https://cve.now/CVE-2023-31229.md): WordPress WP Directory Kit Plugin \<= 1.1.9 is vulnerable to Open Redirection (CVSS 4.7, WP Directory Kit)
- [CVE-2023-31095](https://cve.now/CVE-2023-31095.md): WordPress Integration for Contact Form 7 HubSpot Plugin \<= 1.2.8 is vulnerable to Open Redirection (CVSS 4.7, CRM Perks Integration for HubSpot and Contact Form 7, WPFor…)
- [CVE-2023-28786](https://cve.now/CVE-2023-28786.md): WordPress Solid Security Plugin \<= 8.1.4 is vulnerable to Open Redirection (CVSS 3.7, SolidWP Solid Security – Password, Two Factor Authenticatio…)
- [CVE-2022-44589](https://cve.now/CVE-2022-44589.md): WordPress miniOrange's Google Authenticator Plugin \<= 5.6.1 is vulnerable to Sensitive Data Exposure (CVSS 8.1, miniOrange's Google Authenticator – WordPress Two Factor Au…)
- [CVE-2023-4468](https://cve.now/CVE-2023-4468.md): Poly Trio 8500/Trio 8800/Trio C60 Poly Lens Management Cloud Registration authorization (CVSS 4.3, Poly Trio)
- [CVE-2023-4467](https://cve.now/CVE-2023-4467.md): Poly Trio 8800 Test Automation Mode backdoor (CVSS 6.2, Poly Trio)
- [CVE-2023-4466](https://cve.now/CVE-2023-4466.md): Poly CCX 400/CCX 600/Trio 8800/Trio C60 Web Interface protection mechanism (CVSS 2.7, Poly CCX · Poly Trio)
- [CVE-2023-4465](https://cve.now/CVE-2023-4465.md): Poly VVX 601 Configuration File Import unverified password change (CVSS 2.7, Poly Trio · Poly CCX +10)
- [CVE-2023-4464](https://cve.now/CVE-2023-4464.md): Poly VVX 601 Diagnostic Telnet Mode os command injection (CVSS 7.2, Poly Trio · Poly CCX +10)
- [CVE-2023-4463](https://cve.now/CVE-2023-4463.md): Poly CCX 400/CCX 600/Trio 8800/Trio C60 HTTP Header denial of service (CVSS 5.3, Poly CCX · Poly Trio)
- [CVE-2023-4462](https://cve.now/CVE-2023-4462.md): Poly VVX 601 Web Configuration Application random values (CVSS 3.7, Poly Trio · Poly CCX +10)
- [CVE-2023-51420](https://cve.now/CVE-2023-51420.md): WordPress Verge3D Plugin \<= 4.5.2 is vulnerable to Remote Code Execution (RCE) (CVSS 9.1, Soft8Soft Verge3D Publishing and E-Commerce)
- [CVE-2023-49830](https://cve.now/CVE-2023-49830.md): WordPress Astra Pro Plugin \<= 4.3.1 is vulnerable to Remote Code Execution (RCE) (CVSS 9.9, Brainstorm Force Astra Pro)
- [CVE-2023-47840](https://cve.now/CVE-2023-47840.md): WordPress Qode Essential Addons Plugin \<= 1.5.2 is vulnerable to Remote Code Execution (RCE) (CVSS 9.9, Qode Interactive Qode Essential Addons)
- [CVE-2023-46623](https://cve.now/CVE-2023-46623.md): WordPress WP EXtra Plugin \<= 6.2 is vulnerable to Remote Code Execution (RCE) (CVSS 9.9, TienCOP WP EXtra)
- [CVE-2023-45751](https://cve.now/CVE-2023-45751.md): WordPress Nexter Extension Plugin \<= 2.0.3 is vulnerable to Remote Code Execution (RCE) (CVSS 9.1, POSIMYTH Nexter Extension)
- [CVE-2023-40606](https://cve.now/CVE-2023-40606.md): WordPress Kanban Boards for WordPress Plugin \<= 2.5.21 is vulnerable to Arbitrary Code Execution (CVSS 9.1, Kanban for WordPress Kanban Boards for WordPress)
- [CVE-2023-32095](https://cve.now/CVE-2023-32095.md): WordPress Rename Media Files Plugin \<= 1.0.1 is vulnerable to Remote Code Execution (RCE) (CVSS 9.9, Milan Dinić Rename Media Files)
- [CVE-2023-25054](https://cve.now/CVE-2023-25054.md): WordPress RSVPMarker Plugin \<= 10.6.6 is vulnerable to Remote Code Execution (RCE) (CVSS 10.0, David F. Carr RSVPMaker)
- [CVE-2023-22677](https://cve.now/CVE-2023-22677.md): WordPress WP Booklet Plugin \<= 2.1.8 is vulnerable to Remote Code Execution (RCE) (CVSS 8.5, BinaryStash WP Booklet)
- [CVE-2023-7166](https://cve.now/CVE-2023-7166.md): Novel-Plus HTTP POST Request updateUserInfo cross site scripting (CVSS 3.5, Novel-Plus)
- [CVE-2023-22676](https://cve.now/CVE-2023-22676.md): WordPress Advanced Custom Fields: Image Crop Add-on Plugin \<= 1.4.12 is vulnerable to Broken Access Control (CVSS 3.1, Anders Thorborg)
- [CVE-2023-7161](https://cve.now/CVE-2023-7161.md): Netentsec NS-ASG Application Security Gateway Login sql injection (CVSS 7.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2023-7160](https://cve.now/CVE-2023-7160.md): SourceCodester Engineers Online Portal Add Engineer cross site scripting (CVSS 2.4, SourceCodester Engineers Online Portal)
- [CVE-2023-7159](https://cve.now/CVE-2023-7159.md): gopeak MasterLab User.php update unrestricted upload (CVSS 4.7, gopeak MasterLab)
- [CVE-2023-7158](https://cve.now/CVE-2023-7158.md): MicroPython objslice.c slice\_indices heap-based overflow (CVSS 7.3, MicroPython)
- [CVE-2023-7157](https://cve.now/CVE-2023-7157.md): SourceCodester Free and Open Source Inventory Management System sell\_return\_data.php sql injection (CVSS 6.3, SourceCodester Free and Open Source Inventory Management Sy…)
- [CVE-2023-7156](https://cve.now/CVE-2023-7156.md): Campcodes Online College Library System Search index.php sql injection (CVSS 7.3, Campcodes Online College Library System)
- [CVE-2023-7155](https://cve.now/CVE-2023-7155.md): SourceCodester Free and Open Source Inventory Management System edit\_product.php sql injection (CVSS 6.3, SourceCodester Free and Open Source Inventory Management Sy…)
- [CVE-2023-7152](https://cve.now/CVE-2023-7152.md): MicroPython modselect.c poll\_set\_add\_fd use after free (CVSS 5.5, MicroPython · micropython-os +3)
- [CVE-2023-7150](https://cve.now/CVE-2023-7150.md): Campcodes Chic Beauty Salon Product product-list.php unrestricted upload (CVSS 4.7, Campcodes Chic Beauty Salon)
- [CVE-2023-51435](https://cve.now/CVE-2023-51435.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. (CVSS 7.1, Honor Magic UI)
- [CVE-2023-51434](https://cve.now/CVE-2023-51434.md): Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution. (CVSS 9.3, Honor Magic UI)
- [CVE-2023-51433](https://cve.now/CVE-2023-51433.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. (CVSS 2.9, Honor Magic UI)
- [CVE-2023-51432](https://cve.now/CVE-2023-51432.md): Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak. (CVSS 3.2, Honor Magic UI)
- [CVE-2023-51431](https://cve.now/CVE-2023-51431.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service except (CVSS 7.0, com.hihonor.phoneservice)
- [CVE-2023-51430](https://cve.now/CVE-2023-51430.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. (CVSS 4.4, Honor Magic UI)
- [CVE-2023-51429](https://cve.now/CVE-2023-51429.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. (CVSS 6.0, Honor Magic OS)
- [CVE-2023-51428](https://cve.now/CVE-2023-51428.md): Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. (CVSS 4.6, Honor Magic OS)
- [CVE-2023-7149](https://cve.now/CVE-2023-7149.md): code-projects QR Code Generator cross site scripting (CVSS 3.5, code-projects QR Code Generator)
- [CVE-2023-51427](https://cve.now/CVE-2023-51427.md): Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. (CVSS 4.6, Honor Magic OS)
- [CVE-2023-51426](https://cve.now/CVE-2023-51426.md): Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. (CVSS 4.6, Honor Magic OS)
- [CVE-2023-6939](https://cve.now/CVE-2023-6939.md): Some Honor products are affected by type confusion vulnerability, successful exploitation could cause denial of service. (CVSS 4.0, Honor Magic UI)
- [CVE-2023-23443](https://cve.now/CVE-2023-23443.md): Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. (CVSS 4.6, Honor Magic OS)
- [CVE-2023-23442](https://cve.now/CVE-2023-23442.md): Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. (CVSS 4.6, Honor Magic OS)
- [CVE-2023-23441](https://cve.now/CVE-2023-23441.md): Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak. (CVSS 6.0, Honor Magic UI)
- [CVE-2023-23430](https://cve.now/CVE-2023-23430.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service except (CVSS 3.3, com.hihonor.magichome)
- [CVE-2023-23429](https://cve.now/CVE-2023-23429.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service except (CVSS 4.0, Honor Magic OS)
- [CVE-2023-23428](https://cve.now/CVE-2023-23428.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service except (CVSS 3.3, Honor Magic OS)
- [CVE-2023-7148](https://cve.now/CVE-2023-7148.md): ShifuML shifu Java Expression Language DataPurifier.java code injection (CVSS 5.0, ShifuML shifu · ml.shifu:shifu)
- [CVE-2023-23427](https://cve.now/CVE-2023-23427.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service except (CVSS 4.0, Honor Magic OS)
- [CVE-2023-23426](https://cve.now/CVE-2023-23426.md): Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure. (CVSS 6.6, Honor FRI-AN00)
- [CVE-2023-23424](https://cve.now/CVE-2023-23424.md): Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution (CVSS 6.5, Honor NTH-AN00)
- [CVE-2023-23440](https://cve.now/CVE-2023-23440.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 3.3, Honor LGE-AN00)
- [CVE-2023-23439](https://cve.now/CVE-2023-23439.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 4.0, Honor LGE-AN00)
- [CVE-2023-7147](https://cve.now/CVE-2023-7147.md): gopeak MasterLab User.php base64ImageContent unrestricted upload (CVSS 6.3, gopeak MasterLab)
- [CVE-2023-23438](https://cve.now/CVE-2023-23438.md): Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service except (CVSS 4.0, Honor LGE-AN00)
- [CVE-2023-23437](https://cve.now/CVE-2023-23437.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak (CVSS 3.3, com.hihonor.vmall)
- [CVE-2023-23436](https://cve.now/CVE-2023-23436.md): Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrit (CVSS 7.3, Honor Magic OS)
- [CVE-2023-23435](https://cve.now/CVE-2023-23435.md): Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrit (CVSS 4.0, Honor Magic OS)
- [CVE-2023-23434](https://cve.now/CVE-2023-23434.md): Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. (CVSS 4.0, HonorBoardApp)
- [CVE-2023-7146](https://cve.now/CVE-2023-7146.md): gopeak MasterLab HTTP POST Request Feature.php sqlInjectDelete sql injection (CVSS 6.3, gopeak MasterLab)
- [CVE-2023-23433](https://cve.now/CVE-2023-23433.md): Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrit (CVSS 4.0, Honor NTH-AN00)
- [CVE-2023-23431](https://cve.now/CVE-2023-23431.md): Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrit (CVSS 7.3, Honor NTH-AN00)
- [CVE-2023-7145](https://cve.now/CVE-2023-7145.md): gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection (CVSS 6.3, gopeak MasterLab)
- [CVE-2023-23432](https://cve.now/CVE-2023-23432.md): Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrit (CVSS 7.3, Honor NTH-AN00)
- [CVE-2023-7144](https://cve.now/CVE-2023-7144.md): gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection (CVSS 6.3, gopeak MasterLab)
- [CVE-2023-7143](https://cve.now/CVE-2023-7143.md): code-projects Client Details System regester.php cross site scripting (CVSS 2.4, code-projects Client Details System)
- [CVE-2023-7142](https://cve.now/CVE-2023-7142.md): code-projects Client Details System clientview.php sql injection (CVSS 4.3, code-projects Client Details System)
- [CVE-2023-52085](https://cve.now/CVE-2023-52085.md): Winter CMS Local File Inclusion through Server Side Template Injection (CVSS 3.3, wintercms winter · winter/wn-backend-module)
- [CVE-2023-23634](https://cve.now/CVE-2023-23634.md): SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/ (no CVSS)
- [CVE-2023-31292](https://cve.now/CVE-2023-31292.md): An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive informa (CVSS 5.5)
- [CVE-2023-31293](https://cve.now/CVE-2023-31293.md): An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive inform (no CVSS)
- [CVE-2023-31294](https://cve.now/CVE-2023-31294.md): CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sens (no CVSS)
- [CVE-2023-31295](https://cve.now/CVE-2023-31295.md): CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sens (no CVSS)
- [CVE-2023-31296](https://cve.now/CVE-2023-31296.md): CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive i (CVSS 5.3)
- [CVE-2023-31298](https://cve.now/CVE-2023-31298.md): Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers t (no CVSS)
- [CVE-2023-31299](https://cve.now/CVE-2023-31299.md): Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers t (no CVSS)
- [CVE-2023-31300](https://cve.now/CVE-2023-31300.md): An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitiv (CVSS 7.5)
- [CVE-2023-31301](https://cve.now/CVE-2023-31301.md): Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote atta (no CVSS)
- [CVE-2023-31302](https://cve.now/CVE-2023-31302.md): Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execut (no CVSS)
- [CVE-2023-50035](https://cve.now/CVE-2023-50035.md): PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL (no CVSS)
- [CVE-2023-50069](https://cve.now/CVE-2023-50069.md): WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. (no CVSS)
- [CVE-2023-50070](https://cve.now/CVE-2023-50070.md): Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer\_support/ajax.php?action=save\_ticket via d (no CVSS)
- [CVE-2023-50071](https://cve.now/CVE-2023-50071.md): Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer\_support/ajax.php?action=save\_department v (CVSS 8.8)
- [CVE-2023-50559](https://cve.now/CVE-2023-50559.md): An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache. (no CVSS)
- [CVE-2023-50570](https://cve.now/CVE-2023-50570.md): An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. (no CVSS)
- [CVE-2023-50571](https://cve.now/CVE-2023-50571.md): easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule. (no CVSS, org.jeasy:easy-rules-mvel)
- [CVE-2023-50572](https://cve.now/CVE-2023-50572.md): An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error. (CVSS 5.5, org.jline:jline-parent)
- [CVE-2023-52173](https://cve.now/CVE-2023-52173.md): XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0. (no CVSS)
- [CVE-2023-52174](https://cve.now/CVE-2023-52174.md): XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6. (no CVSS)
- [CVE-2023-52240](https://cve.now/CVE-2023-52240.md): The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.