# CVEs published 2023-12-31

34 CVEs were published on December 31, 2023: 6 critical, 8 high. Days are UTC.

- [CVE-2023-51503](https://cve.now/CVE-2023-51503.md): WordPress WooCommerce Payments Plugin \<= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 5.9, Automattic WooPayments – Fully Integrated Solution Built an…)
- [CVE-2023-51423](https://cve.now/CVE-2023-51423.md): WordPress WebinarIgnition Plugin \<= 3.05.0 is vulnerable to SQL Injection (CVSS 9.3, Saleswonder Team Webinar Plugin: Create live/evergreen/auto…)
- [CVE-2023-51469](https://cve.now/CVE-2023-51469.md): WordPress Checkout Mestres WP Plugin \<= 7.1.9.6 is vulnerable to SQL Injection (CVSS 9.3, Mestres do WP Checkout Mestres WP)
- [CVE-2023-52131](https://cve.now/CVE-2023-52131.md): WordPress Page Generator Plugin \<= 1.7.1 is vulnerable to SQL Injection (CVSS 7.6, WP Zinc Page Generator)
- [CVE-2023-51547](https://cve.now/CVE-2023-51547.md): WordPress Fluent Support Plugin \<= 1.7.6 is vulnerable to SQL Injection (CVSS 7.6, WPManageNinja Fluent Support – WordPress Helpdesk and Custo…)
- [CVE-2023-52132](https://cve.now/CVE-2023-52132.md): WordPress WP Adminify Plugin \<= 3.1.6 is vulnerable to SQL Injection (CVSS 7.6, Jewel Theme WP Adminify)
- [CVE-2023-52133](https://cve.now/CVE-2023-52133.md): WordPress Most And Least Read Posts Widget Plugin \<= 2.5.16 is vulnerable to SQL Injection (CVSS 8.5, WhileTrue Most And Least Read Posts Widget)
- [CVE-2023-52134](https://cve.now/CVE-2023-52134.md): WordPress GEO my WordPress Plugin \<= 4.0.2 is vulnerable to SQL Injection (CVSS 7.6, Eyal Fitoussi GEO my WordPress)
- [CVE-2023-52185](https://cve.now/CVE-2023-52185.md): WordPress Everest Backup Plugin \<= 2.1.9 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Everestthemes Everest Backup – WordPress Cloud Backup, Migr…)
- [CVE-2023-7193](https://cve.now/CVE-2023-7193.md): MTab Bookmark Installation install.php access control (CVSS 4.6, MTab Bookmark)
- [CVE-2023-7191](https://cve.now/CVE-2023-7191.md): S-CMS reg.php sql injection (CVSS 5.5, S-CMS)
- [CVE-2023-7190](https://cve.now/CVE-2023-7190.md): S-CMS sql injection (CVSS 5.5, S-CMS)
- [CVE-2023-7189](https://cve.now/CVE-2023-7189.md): S-CMS sql injection (CVSS 5.5, S-CMS)
- [CVE-2023-7188](https://cve.now/CVE-2023-7188.md): Shipping 100 Fahuo100 login.php sql injection (CVSS 5.0, Shipping 100 Fahuo100)
- [CVE-2023-7187](https://cve.now/CVE-2023-7187.md): Totolink N350RT HTTP POST Request stack-based overflow (CVSS 5.5, Totolink N350RT)
- [CVE-2023-7186](https://cve.now/CVE-2023-7186.md): 7-card Fakabao notify.php sql injection (CVSS 5.5, 7-card Fakabao)
- [CVE-2023-7185](https://cve.now/CVE-2023-7185.md): 7-card Fakabao wxpay\_notify.php sql injection (CVSS 5.5, 7-card Fakabao)
- [CVE-2023-7184](https://cve.now/CVE-2023-7184.md): 7-card Fakabao notify.php sql injection (CVSS 5.5, 7-card Fakabao)
- [CVE-2023-7183](https://cve.now/CVE-2023-7183.md): 7-card Fakabao alipay\_notify.php sql injection (CVSS 5.5, 7-card Fakabao)
- [CVE-2023-52180](https://cve.now/CVE-2023-52180.md): WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin \<= 8.1.0 is vulnerable to SQL Injection (CVSS 7.6, Really Simple Plugins Recipe Maker For Your Food Blog from…)
- [CVE-2023-49777](https://cve.now/CVE-2023-49777.md): WordPress YITH WooCommerce Product Add-Ons Plugin \<= 4.3.0 is vulnerable to PHP Object Injection (CVSS 9.1, YITH WooCommerce Product Add-Ons)
- [CVE-2023-52181](https://cve.now/CVE-2023-52181.md): WordPress Theme per user Plugin \<= 1.0.1 is vulnerable to PHP Object Injection (CVSS 10.0, Presslabs Theme per user)
- [CVE-2023-39157](https://cve.now/CVE-2023-39157.md): WordPress JetElements For Elementor Plugin \<= 2.6.10 is vulnerable to Remote Code Execution (RCE) (CVSS 9.0, Crocoblock JetElements For Elementor)
- [CVE-2023-6094](https://cve.now/CVE-2023-6094.md): OnCell G3150A-LTE Series: Web Server Transmits Cleartext Credentials (CVSS 5.3, Moxa OnCell G3150A-LTE Series)
- [CVE-2023-52182](https://cve.now/CVE-2023-52182.md): WordPress ARI Stream Quiz Plugin \<= 1.3.0 is vulnerable to PHP Object Injection (CVSS 9.9, ARI Soft ARI Stream Quiz – WordPress Quizzes Builder)
- [CVE-2023-6093](https://cve.now/CVE-2023-6093.md): OnCell G3150A-LTE Series: Clickjacking Vulnerability (CVSS 5.3, Moxa OnCell G3150A-LTE Series)
- [CVE-2023-7130](https://cve.now/CVE-2023-7130.md): code-projects College Notes Gallery login.php sql injection (CVSS 6.3, code-projects College Notes Gallery)
- [CVE-2021-46900](https://cve.now/CVE-2021-46900.md): Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an (CVSS 7.5)
- [CVE-2021-46901](https://cve.now/CVE-2021-46901.md): examples/6lbr/apps/6lbr-webserver/httpd.c in CETIC-6LBR (aka 6lbr) 1.5.0 has a strcat stack-based buffer overflow via a request for a long U (no CVSS)
- [CVE-2023-52269](https://cve.now/CVE-2023-52269.md): MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. (no CVSS)
- [CVE-2023-52275](https://cve.now/CVE-2023-52275.md): Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.enc (no CVSS)
- [CVE-2023-52277](https://cve.now/CVE-2023-52277.md): Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have (no CVSS)
- [CVE-2023-52284](https://cve.now/CVE-2023-52284.md): Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for (no CVSS)
- [CVE-2023-52286](https://cve.now/CVE-2023-52286.md): Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get\_ (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.