CVEs published December 31, 2023
34 CVEs were published on December 31, 2023: 6 critical, 8 high.
- Published
- 34
- Critical
- 6
- High
- 8
- Medium
- 15
- Low
- 0
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- 7-card Fakabao
- 4
- S-CMS
- 3
- Moxa OnCell G3150A-LTE Series
- 2
- ARI Soft ARI Stream Quiz – WordPress Quizzes Builder
- 1
- Automattic WooPayments – Fully Integrated Solution Built an…
- 1
- code-projects College Notes Gallery
- 1
- Crocoblock JetElements For Elementor
- 1
- Everestthemes Everest Backup – WordPress Cloud Backup, Migr…
- 1
- Eyal Fitoussi GEO my WordPress
- 1
- Jewel Theme WP Adminify
- 1
Critical 6
- CVE-2023-51423WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to SQL InjectionSaleswonder Team Webinar Plugin: Create live/evergreen/auto…
- CVE-2023-51469WordPress Checkout Mestres WP Plugin <= 7.1.9.6 is vulnerable to SQL InjectionMestres do WP Checkout Mestres WP
- CVE-2023-49777WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object InjectionYITH WooCommerce Product Add-Ons
- CVE-2023-52181WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object InjectionPresslabs Theme per user
- CVE-2023-39157WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)Crocoblock JetElements For Elementor
- CVE-2023-52182WordPress ARI Stream Quiz Plugin <= 1.3.0 is vulnerable to PHP Object InjectionARI Soft ARI Stream Quiz – WordPress Quizzes Builder
High 8
- CVE-2023-52131WordPress Page Generator Plugin <= 1.7.1 is vulnerable to SQL InjectionWP Zinc Page Generator
- CVE-2023-51547WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL InjectionWPManageNinja Fluent Support – WordPress Helpdesk and Custo…
- CVE-2023-52132WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to SQL InjectionJewel Theme WP Adminify
- CVE-2023-52133WordPress Most And Least Read Posts Widget Plugin <= 2.5.16 is vulnerable to SQL InjectionWhileTrue Most And Least Read Posts Widget
- CVE-2023-52134WordPress GEO my WordPress Plugin <= 4.0.2 is vulnerable to SQL InjectionEyal Fitoussi GEO my WordPress
- CVE-2023-52180WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.1.0 is vulnerable to SQL InjectionReally Simple Plugins Recipe Maker For Your Food Blog from…
- CVE-2021-46900Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an
- CVE-2023-52286Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_
Medium, low and unrated 20
- CVE-2023-51503WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)Automattic WooPayments – Fully Integrated Solution Built an…
- CVE-2023-52185WordPress Everest Backup Plugin <= 2.1.9 is vulnerable to Sensitive Data ExposureEverestthemes Everest Backup – WordPress Cloud Backup, Migr…
- CVE-2023-7193MTab Bookmark Installation install.php access controlMTab Bookmark
- CVE-2023-7191S-CMS reg.php sql injectionS-CMS
- CVE-2023-7190S-CMS sql injectionS-CMS
- CVE-2023-7189S-CMS sql injectionS-CMS
- CVE-2023-7188Shipping 100 Fahuo100 login.php sql injectionShipping 100 Fahuo100
- CVE-2023-7187Totolink N350RT HTTP POST Request stack-based overflowTotolink N350RT
- CVE-2023-71867-card Fakabao notify.php sql injection7-card Fakabao
- CVE-2023-71857-card Fakabao wxpay_notify.php sql injection7-card Fakabao
- CVE-2023-71847-card Fakabao notify.php sql injection7-card Fakabao
- CVE-2023-71837-card Fakabao alipay_notify.php sql injection7-card Fakabao
- CVE-2023-6094OnCell G3150A-LTE Series: Web Server Transmits Cleartext CredentialsMoxa OnCell G3150A-LTE Series
- CVE-2023-6093OnCell G3150A-LTE Series: Clickjacking VulnerabilityMoxa OnCell G3150A-LTE Series
- CVE-2023-7130code-projects College Notes Gallery login.php sql injectioncode-projects College Notes Gallery
- CVE-2021-46901examples/6lbr/apps/6lbr-webserver/httpd.c in CETIC-6LBR (aka 6lbr) 1.5.0 has a strcat stack-based buffer overflow via a request for a long U
- CVE-2023-52269MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule.
- CVE-2023-52275Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.enc
- CVE-2023-52277Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have
- CVE-2023-52284Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for