# Vulnerabilities published in 2023


- [CVE-2023-7289](https://insights.sbomify.com/CVE-2023-7289/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys' (medium 5.4)
- [CVE-2023-7288](https://insights.sbomify.com/CVE-2023-7288/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'update_profile_preference' (medium 5.4)
- [CVE-2023-7287](https://insights.sbomify.com/CVE-2023-7287/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription' (medium 5.4)
- [CVE-2023-7286](https://insights.sbomify.com/CVE-2023-7286/): ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference (medium 6.5)
- [CVE-2023-7282](https://insights.sbomify.com/CVE-2023-7282/): Other in Chrome (medium 4.3)
- [CVE-2023-7281](https://insights.sbomify.com/CVE-2023-7281/): Other in Chrome (medium 4.3)
- [CVE-2023-7279](https://insights.sbomify.com/CVE-2023-7279/): Secure Systems Engineering Connaisseur Delegation Name targets_schema.json redos (low 2.1)
- [CVE-2023-7273](https://insights.sbomify.com/CVE-2023-7273/): Cross Site Request Forgery in Kiteworks OwnCloud (medium 6.8)
- [CVE-2023-7272](https://insights.sbomify.com/CVE-2023-7272/): Eclipse Parsson stack overflow with deeply nested objects (high 8.6)
- [CVE-2023-7271](https://insights.sbomify.com/CVE-2023-7271/): Privilege escalation in EMUI (medium 5.5)
- [CVE-2023-7270](https://insights.sbomify.com/CVE-2023-7270/): Local Privilege Escalation via MSI installer (medium 5.3)
- [CVE-2023-7269](https://insights.sbomify.com/CVE-2023-7269/): ArtPlacer Widget < 2.21.2 - Stored XSS via CSRF (high 7.5)
- [CVE-2023-7268](https://insights.sbomify.com/CVE-2023-7268/): ArtPlacer Widget < 2.21.2 - Subscriber+ Arbitrary Widget Deletion (medium 6.5)
- [CVE-2023-7266](https://insights.sbomify.com/CVE-2023-7266/): Other in TC7001-10 (high 7.5)
- [CVE-2023-7265](https://insights.sbomify.com/CVE-2023-7265/): Missing authorization in EMUI (medium 4.0)
- [CVE-2023-7264](https://insights.sbomify.com/CVE-2023-7264/): Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism (high 8.1)
- [CVE-2023-7263](https://insights.sbomify.com/CVE-2023-7263/): Path traversal in HarmonyOS AILife Solution 8.0 (high 7.3)
- [CVE-2023-7261](https://insights.sbomify.com/CVE-2023-7261/): Privilege escalation in Omaha (high 7.3)
- [CVE-2023-7260](https://insights.sbomify.com/CVE-2023-7260/): A path traversal vulnerability has been discovered in OpenText™ CX-E Voice. (medium 6.9)
- [CVE-2023-7259](https://insights.sbomify.com/CVE-2023-7259/): zzdevelop lenosp Adduser Page cross site scripting (medium 5.1)
- [CVE-2023-7258](https://insights.sbomify.com/CVE-2023-7258/): Denial-of-Service in Gvisor (medium 4.8)
- [CVE-2023-7256](https://insights.sbomify.com/CVE-2023-7256/): Double-free in libpcap before 1.10.5 with remote packet capture support. (medium 4.4)
- [CVE-2023-7253](https://insights.sbomify.com/CVE-2023-7253/): Import WP < 2.13.1 - Admin+ Server-side Request Forgery (medium 6.1)
- [CVE-2023-7252](https://insights.sbomify.com/CVE-2023-7252/): Tickera < 3.5.2.5 - Ticket leakage through IDOR (medium 5.3)
- [CVE-2023-7251](https://insights.sbomify.com/CVE-2023-7251/): WordPress User Submitted Posts plugin <= 20230901 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2023-7250](https://insights.sbomify.com/CVE-2023-7250/): Iperf3: possible denial of service (medium 5.3)
- [CVE-2023-7249](https://insights.sbomify.com/CVE-2023-7249/): Path traversal in OpenText Directory Services (medium 6.3)
- [CVE-2023-7248](https://insights.sbomify.com/CVE-2023-7248/): OpenText Vertica Management console might be prone to bypass via crafted requests (medium 5.0)
- [CVE-2023-7247](https://insights.sbomify.com/CVE-2023-7247/): Login as User or Customer <= 3.8 - Admin Account Takeover (medium 4.9)
- [CVE-2023-7246](https://insights.sbomify.com/CVE-2023-7246/): System Dashboard < 2.8.10 - XSS via Header Injection (medium 5.4)
- [CVE-2023-7245](https://insights.sbomify.com/CVE-2023-7245/): Code injection in OpenVPN Connect (high 7.8)
- [CVE-2023-7244](https://insights.sbomify.com/CVE-2023-7244/): Ethercat Zeek Plugin Out-of-bounds Write (critical 9.8)
- [CVE-2023-7243](https://insights.sbomify.com/CVE-2023-7243/): Ethercat Zeek Plugin Out-of-bounds Write (critical 9.8)
- [CVE-2023-7242](https://insights.sbomify.com/CVE-2023-7242/): Ethercat Zeek Plugin Out-of-bounds Read (high 8.2)
- [CVE-2023-7241](https://insights.sbomify.com/CVE-2023-7241/): Webroot Antivirus COM-Hijacking LPE (high 7.9)
- [CVE-2023-7240](https://insights.sbomify.com/CVE-2023-7240/): Broken Access Control leading to SSRF in NetIQ Identity Console (medium 5.8)
- [CVE-2023-7239](https://insights.sbomify.com/CVE-2023-7239/): wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR (high 7.5)
- [CVE-2023-7238](https://insights.sbomify.com/CVE-2023-7238/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer (high 7.1)
- [CVE-2023-7237](https://insights.sbomify.com/CVE-2023-7237/): Lantronix XPort Weak Encoding for Password (medium 5.7)
- [CVE-2023-7236](https://insights.sbomify.com/CVE-2023-7236/): Backup Bolt <= 1.3.0 - Sensitive Data Exposure (medium 4.7)
- [CVE-2023-7235](https://insights.sbomify.com/CVE-2023-7235/): Misconfiguration in OpenVPN (high 8.4)
- [CVE-2023-7234](https://insights.sbomify.com/CVE-2023-7234/): Integration Objects OPC UA Server Toolkit Improper Output Neutralization for Logs (medium 5.3)
- [CVE-2023-7233](https://insights.sbomify.com/CVE-2023-7233/): GigPress <= 2.3.29 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2023-7232](https://insights.sbomify.com/CVE-2023-7232/): Backup and Restore WordPress <= 1.45 - Unauthenticated Sensitive Data Exposure (medium 5.3)
- [CVE-2023-7231](https://insights.sbomify.com/CVE-2023-7231/): illi Link Party! <= 1.0 - Unauthenticated Arbitrary Link Deletion (high 7.3)
- [CVE-2023-7230](https://insights.sbomify.com/CVE-2023-7230/): illi Link Party! <= 1.0 - Admin+ Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-7229](https://insights.sbomify.com/CVE-2023-7229/): illi Link Party! <= 1.0 - Settings Update via CSRF (medium 5.5)
- [CVE-2023-7228](https://insights.sbomify.com/CVE-2023-7228/): illi Link Party! <= 1.0 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-7227](https://insights.sbomify.com/CVE-2023-7227/): Command Injection vulnerability in SystemK NVR 504/508/516 (critical 9.8)
- [CVE-2023-7226](https://insights.sbomify.com/CVE-2023-7226/): meetyoucrop big-whale Admin Module all.api improper ownership management (medium 6.3)
- [CVE-2023-7225](https://insights.sbomify.com/CVE-2023-7225/): MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings (medium 6.4)
- [CVE-2023-7224](https://insights.sbomify.com/CVE-2023-7224/): Code injection in OpenVPN Connect (high 7.8)
- [CVE-2023-7223](https://insights.sbomify.com/CVE-2023-7223/): Totolink T6 cstecgi.cgi access control (medium 5.3)
- [CVE-2023-7222](https://insights.sbomify.com/CVE-2023-7222/): Totolink X2000R HTTP POST Request boa formTmultiAP buffer overflow (high 7.2)
- [CVE-2023-7221](https://insights.sbomify.com/CVE-2023-7221/): Totolink T6 HTTP POST Request main buffer overflow (critical 9.8)
- [CVE-2023-7220](https://insights.sbomify.com/CVE-2023-7220/): Totolink NR1800X cstecgi.cgi loginAuth stack-based overflow (critical 9.8)
- [CVE-2023-7219](https://insights.sbomify.com/CVE-2023-7219/): Totolink N350RT cstecgi.cgi loginAuth stack-based overflow (high 7.2)
- [CVE-2023-7218](https://insights.sbomify.com/CVE-2023-7218/): Totolink N350RT cstecgi.cgi loginAuth stack-based overflow (high 7.2)
- [CVE-2023-7216](https://insights.sbomify.com/CVE-2023-7216/): Cpio: extraction allows symlinks which enables remote command execution (medium 5.3)
- [CVE-2023-7215](https://insights.sbomify.com/CVE-2023-7215/): Chanzhaoyu chatgpt-web cross site scripting (low 3.5)
- [CVE-2023-7214](https://insights.sbomify.com/CVE-2023-7214/): Totolink N350RT HTTP POST Request main stack-based overflow (medium 6.3)
- [CVE-2023-7213](https://insights.sbomify.com/CVE-2023-7213/): Totolink N350RT HTTP POST Request main stack-based overflow (medium 6.3)
- [CVE-2023-7212](https://insights.sbomify.com/CVE-2023-7212/): DeDeCMS Backend file_class.php unrestricted upload (medium 4.7)
- [CVE-2023-7211](https://insights.sbomify.com/CVE-2023-7211/): Uniway Router Administrative Web Interface reliance on ip address for authentication (medium 5.6)
- [CVE-2023-7210](https://insights.sbomify.com/CVE-2023-7210/): OneNav API improper authentication (high 7.3)
- [CVE-2023-7209](https://insights.sbomify.com/CVE-2023-7209/): Uniway Router Device Reset device_reset.cgi denial of service (high 7.5)
- [CVE-2023-7208](https://insights.sbomify.com/CVE-2023-7208/): Totolink X2000R_V2 boa formTmultiAP buffer overflow (high 8.0)
- [CVE-2023-7207](https://insights.sbomify.com/CVE-2023-7207/): Path traversal in Debian cpio (medium 4.9)
- [CVE-2023-7206](https://insights.sbomify.com/CVE-2023-7206/): Horner Automation Cscape Stack-Based Buffer Overflow (high 7.8)
- [CVE-2023-7204](https://insights.sbomify.com/CVE-2023-7204/): WP STAGING WordPress Backup Plugin < 3.2.0 - Unauthorized Sensitive Data Exposure (high 7.5)
- [CVE-2023-7203](https://insights.sbomify.com/CVE-2023-7203/): Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry Deletion (medium 6.1)
- [CVE-2023-7202](https://insights.sbomify.com/CVE-2023-7202/): Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email Sending (medium 6.1)
- [CVE-2023-7201](https://insights.sbomify.com/CVE-2023-7201/): Everest Backup < 2.2.5 - Admin+ Arbitrary File Upload (medium 6.5)
- [CVE-2023-7200](https://insights.sbomify.com/CVE-2023-7200/): EventON < 4.4.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-7199](https://insights.sbomify.com/CVE-2023-7199/): Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure (medium 5.3)
- [CVE-2023-7198](https://insights.sbomify.com/CVE-2023-7198/): WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private Notes (medium 4.3)
- [CVE-2023-7197](https://insights.sbomify.com/CVE-2023-7197/): Marketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRF (high 7.1)
- [CVE-2023-7196](https://insights.sbomify.com/CVE-2023-7196/): Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRF (medium 4.3)
- [CVE-2023-7195](https://insights.sbomify.com/CVE-2023-7195/): WP-Reply Notify <= 1.1 - Settings Update via CSRF (medium 4.3)
- [CVE-2023-7194](https://insights.sbomify.com/CVE-2023-7194/): Meris <= 1.1.2 - Reflected XSS (medium 6.1)
- [CVE-2023-7193](https://insights.sbomify.com/CVE-2023-7193/): MTab Bookmark Installation install.php access control (medium 4.6)
- [CVE-2023-7192](https://insights.sbomify.com/CVE-2023-7192/): Kernel: refcount leak in ctnetlink_create_conntrack() (medium 5.5)
- [CVE-2023-7191](https://insights.sbomify.com/CVE-2023-7191/): S-CMS reg.php sql injection (medium 5.5)
- [CVE-2023-7190](https://insights.sbomify.com/CVE-2023-7190/): S-CMS sql injection (medium 5.5)
- [CVE-2023-7189](https://insights.sbomify.com/CVE-2023-7189/): S-CMS sql injection (medium 5.5)
- [CVE-2023-7188](https://insights.sbomify.com/CVE-2023-7188/): Shipping 100 Fahuo100 login.php sql injection (medium 5.0)
- [CVE-2023-7187](https://insights.sbomify.com/CVE-2023-7187/): Totolink N350RT HTTP POST Request stack-based overflow (medium 5.5)
- [CVE-2023-7186](https://insights.sbomify.com/CVE-2023-7186/): 7-card Fakabao notify.php sql injection (medium 5.5)
- [CVE-2023-7185](https://insights.sbomify.com/CVE-2023-7185/): 7-card Fakabao wxpay_notify.php sql injection (medium 5.5)
- [CVE-2023-7184](https://insights.sbomify.com/CVE-2023-7184/): 7-card Fakabao notify.php sql injection (medium 5.5)
- [CVE-2023-7183](https://insights.sbomify.com/CVE-2023-7183/): 7-card Fakabao alipay_notify.php sql injection (medium 5.5)
- [CVE-2023-7181](https://insights.sbomify.com/CVE-2023-7181/): Muyun DedeBIZ Add Attachment unrestricted upload (medium 4.7)
- [CVE-2023-7180](https://insights.sbomify.com/CVE-2023-7180/): Tongda OA 2017 delete.php sql injection (medium 5.5)
- [CVE-2023-7179](https://insights.sbomify.com/CVE-2023-7179/): Campcodes Online College Library System HTTP POST Request category_row.php sql injection (medium 4.7)
- [CVE-2023-7178](https://insights.sbomify.com/CVE-2023-7178/): Campcodes Online College Library System HTTP POST Request book_row.php sql injection (medium 4.7)
- [CVE-2023-7177](https://insights.sbomify.com/CVE-2023-7177/): Campcodes Online College Library System HTTP POST Request book_add.php sql injection (medium 4.7)
- [CVE-2023-7176](https://insights.sbomify.com/CVE-2023-7176/): Campcodes Online College Library System HTTP POST Request return_add.php sql injection (medium 4.7)
- [CVE-2023-7175](https://insights.sbomify.com/CVE-2023-7175/): Campcodes Online College Library System HTTP POST Request borrow_add.php sql injection (medium 4.7)
- [CVE-2023-7174](https://insights.sbomify.com/CVE-2023-7174/): aBitGone CommentSafe <= 1.0.0 - Settings Update to Stored XSS via CSRF (high 7.1)
- [CVE-2023-7173](https://insights.sbomify.com/CVE-2023-7173/): PHPGurukul Hospital Management System registration.php cross site scripting (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/124/