# Vulnerabilities published in 2023


- [CVE-2023-7172](https://insights.sbomify.com/CVE-2023-7172/): PHPGurukul Hospital Management System Admin Dashboard sql injection (high 7.3)
- [CVE-2023-7171](https://insights.sbomify.com/CVE-2023-7171/): Novel-Plus Friendly Link FriendLinkController.java cross site scripting (low 2.4)
- [CVE-2023-7170](https://insights.sbomify.com/CVE-2023-7170/): EventON-RSVP < 2.9.5 - Reflected XSS (medium 6.1)
- [CVE-2023-7169](https://insights.sbomify.com/CVE-2023-7169/): Impersonate vendor signed Powershell scripts (medium 6.0)
- [CVE-2023-7168](https://insights.sbomify.com/CVE-2023-7168/): Better Follow Button for Jetpack <= 8.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-7167](https://insights.sbomify.com/CVE-2023-7167/): Persian Fonts <= 1.6 - Admin+ Stored XSS (medium 6.1)
- [CVE-2023-7166](https://insights.sbomify.com/CVE-2023-7166/): Novel-Plus HTTP POST Request updateUserInfo cross site scripting (low 3.5)
- [CVE-2023-7165](https://insights.sbomify.com/CVE-2023-7165/): JetBackup < 2.0.9.9 - Directory Listing Exposing Backups (high 7.5)
- [CVE-2023-7164](https://insights.sbomify.com/CVE-2023-7164/): BackWPup < 4.0.4 - Unauthenticated Backup Download (high 7.5)
- [CVE-2023-7163](https://insights.sbomify.com/CVE-2023-7163/): D-Link D-View 8 Unauthenticated Probe-Core Server Communication (critical 10.0)
- [CVE-2023-7161](https://insights.sbomify.com/CVE-2023-7161/): Netentsec NS-ASG Application Security Gateway Login sql injection (high 7.3)
- [CVE-2023-7160](https://insights.sbomify.com/CVE-2023-7160/): SourceCodester Engineers Online Portal Add Engineer cross site scripting (low 2.4)
- [CVE-2023-7159](https://insights.sbomify.com/CVE-2023-7159/): gopeak MasterLab User.php update unrestricted upload (medium 4.7)
- [CVE-2023-7158](https://insights.sbomify.com/CVE-2023-7158/): MicroPython objslice.c slice_indices heap-based overflow (high 7.3)
- [CVE-2023-7157](https://insights.sbomify.com/CVE-2023-7157/): SourceCodester Free and Open Source Inventory Management System sell_return_data.php sql injection (medium 6.3)
- [CVE-2023-7156](https://insights.sbomify.com/CVE-2023-7156/): Campcodes Online College Library System Search index.php sql injection (high 7.3)
- [CVE-2023-7155](https://insights.sbomify.com/CVE-2023-7155/): SourceCodester Free and Open Source Inventory Management System edit_product.php sql injection (medium 6.3)
- [CVE-2023-7154](https://insights.sbomify.com/CVE-2023-7154/): Hubbub Lite < 1.32.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-7153](https://insights.sbomify.com/CVE-2023-7153/): Reflected XSS in Macroturk's Macro-Bel (medium 6.1)
- [CVE-2023-7152](https://insights.sbomify.com/CVE-2023-7152/): MicroPython modselect.c poll_set_add_fd use after free (medium 5.5)
- [CVE-2023-7151](https://insights.sbomify.com/CVE-2023-7151/): Product Enquiry for WooCommerce < 3.2 - Reflected XSS (medium 6.1)
- [CVE-2023-7150](https://insights.sbomify.com/CVE-2023-7150/): Campcodes Chic Beauty Salon Product product-list.php unrestricted upload (medium 4.7)
- [CVE-2023-7149](https://insights.sbomify.com/CVE-2023-7149/): code-projects QR Code Generator cross site scripting (low 3.5)
- [CVE-2023-7148](https://insights.sbomify.com/CVE-2023-7148/): ShifuML shifu Java Expression Language DataPurifier.java code injection (medium 5.0)
- [CVE-2023-7147](https://insights.sbomify.com/CVE-2023-7147/): gopeak MasterLab User.php base64ImageContent unrestricted upload (medium 6.3)
- [CVE-2023-7146](https://insights.sbomify.com/CVE-2023-7146/): gopeak MasterLab HTTP POST Request Feature.php sqlInjectDelete sql injection (medium 6.3)
- [CVE-2023-7145](https://insights.sbomify.com/CVE-2023-7145/): gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection (medium 6.3)
- [CVE-2023-7144](https://insights.sbomify.com/CVE-2023-7144/): gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection (medium 6.3)
- [CVE-2023-7143](https://insights.sbomify.com/CVE-2023-7143/): code-projects Client Details System regester.php cross site scripting (low 2.4)
- [CVE-2023-7142](https://insights.sbomify.com/CVE-2023-7142/): code-projects Client Details System clientview.php sql injection (medium 4.3)
- [CVE-2023-7141](https://insights.sbomify.com/CVE-2023-7141/): code-projects Client Details System update-clients.php sql injection (medium 4.3)
- [CVE-2023-7140](https://insights.sbomify.com/CVE-2023-7140/): code-projects Client Details System manage-users.php sql injection (medium 4.3)
- [CVE-2023-7139](https://insights.sbomify.com/CVE-2023-7139/): code-projects Client Details System HTTP POST Request regester.php sql injection (medium 4.3)
- [CVE-2023-7138](https://insights.sbomify.com/CVE-2023-7138/): code-projects Client Details System HTTP POST Request admin sql injection (medium 6.3)
- [CVE-2023-7137](https://insights.sbomify.com/CVE-2023-7137/): code-projects Client Details System HTTP POST Request sql injection (medium 6.3)
- [CVE-2023-7136](https://insights.sbomify.com/CVE-2023-7136/): code-projects Record Management System Document Type doctype.php cross site scripting (low 2.4)
- [CVE-2023-7135](https://insights.sbomify.com/CVE-2023-7135/): code-projects Record Management System Offices offices.php cross site scripting (low 2.4)
- [CVE-2023-7134](https://insights.sbomify.com/CVE-2023-7134/): SourceCodester Medicine Tracking System path traversal (medium 6.3)
- [CVE-2023-7133](https://insights.sbomify.com/CVE-2023-7133/): y_project RuoYi HTTP POST Request login cross site scripting (medium 4.3)
- [CVE-2023-7132](https://insights.sbomify.com/CVE-2023-7132/): code-projects Intern Membership Management System User Registration cross site scripting (low 3.5)
- [CVE-2023-7131](https://insights.sbomify.com/CVE-2023-7131/): code-projects Intern Membership Management System User Registration sql injection (medium 6.3)
- [CVE-2023-7130](https://insights.sbomify.com/CVE-2023-7130/): code-projects College Notes Gallery login.php sql injection (medium 6.3)
- [CVE-2023-7129](https://insights.sbomify.com/CVE-2023-7129/): code-projects Voting System Voters Login sql injection (medium 5.5)
- [CVE-2023-7128](https://insights.sbomify.com/CVE-2023-7128/): code-projects Voting System Admin Login sql injection (medium 6.3)
- [CVE-2023-7127](https://insights.sbomify.com/CVE-2023-7127/): code-projects Automated Voting System Login sql injection (medium 6.3)
- [CVE-2023-7126](https://insights.sbomify.com/CVE-2023-7126/): code-projects Automated Voting System Admin Login sql injection (medium 6.3)
- [CVE-2023-7125](https://insights.sbomify.com/CVE-2023-7125/): Community by PeepSo < 6.3.1.2 - User Post Creation via CSRF (medium 4.3)
- [CVE-2023-7124](https://insights.sbomify.com/CVE-2023-7124/): code-projects E-Commerce Site search.php cross site scripting (medium 4.3)
- [CVE-2023-7123](https://insights.sbomify.com/CVE-2023-7123/): SourceCodester Medicine Tracking System sql injection (medium 6.3)
- [CVE-2023-7116](https://insights.sbomify.com/CVE-2023-7116/): WeiYe-Jing datax-web HTTP POST Request killJob os command injection (medium 6.3)
- [CVE-2023-7115](https://insights.sbomify.com/CVE-2023-7115/): PageLayer < 1.8.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-7114](https://insights.sbomify.com/CVE-2023-7114/): Cross-site request forgery in Mattermost (high 7.1)
- [CVE-2023-7113](https://insights.sbomify.com/CVE-2023-7113/): Mattermost Cross-site Scripting vulnerability (low 3.7)
- [CVE-2023-7111](https://insights.sbomify.com/CVE-2023-7111/): code-projects Library Management System index.php sql injection (medium 6.3)
- [CVE-2023-7110](https://insights.sbomify.com/CVE-2023-7110/): code-projects Library Management System login.php sql injection (high 7.3)
- [CVE-2023-7109](https://insights.sbomify.com/CVE-2023-7109/): code-projects Library Management System login.php sql injection (high 7.3)
- [CVE-2023-7108](https://insights.sbomify.com/CVE-2023-7108/): code-projects E-Commerce Website user_signup.php cross site scripting (medium 4.3)
- [CVE-2023-7107](https://insights.sbomify.com/CVE-2023-7107/): code-projects E-Commerce Website user_signup.php sql injection (high 7.3)
- [CVE-2023-7106](https://insights.sbomify.com/CVE-2023-7106/): code-projects E-Commerce Website sql injection (medium 6.3)
- [CVE-2023-7105](https://insights.sbomify.com/CVE-2023-7105/): code-projects E-Commerce Website index_search.php sql injection (medium 4.7)
- [CVE-2023-7104](https://insights.sbomify.com/CVE-2023-7104/): SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow (medium 5.5)
- [CVE-2023-7103](https://insights.sbomify.com/CVE-2023-7103/): Authentication Bypass in ZKSoftware's UFace 5 (critical 9.8)
- [CVE-2023-7102](https://insights.sbomify.com/CVE-2023-7102/): Remote Code Execution (RCE) Vulnerability (critical 9.8)
- [CVE-2023-7101](https://insights.sbomify.com/CVE-2023-7101/): Spreadsheet::ParseExcel Remote Code Execution (high 7.8, exploited in the wild)
- [CVE-2023-7100](https://insights.sbomify.com/CVE-2023-7100/): PHPGurukul Restaurant Table Booking System bwdates-report-details.php sql injection (medium 5.3)
- [CVE-2023-7099](https://insights.sbomify.com/CVE-2023-7099/): PHPGurukul Nipah Virus Testing Management System bwdates-report-result.php sql injection (medium 6.3)
- [CVE-2023-7098](https://insights.sbomify.com/CVE-2023-7098/): icret EasyImages hide.php path traversal (low 3.1)
- [CVE-2023-7097](https://insights.sbomify.com/CVE-2023-7097/): code-projects Water Billing System addbill.php sql injection (medium 6.3)
- [CVE-2023-7096](https://insights.sbomify.com/CVE-2023-7096/): code-projects Faculty Management System crud.php sql injection (medium 5.1)
- [CVE-2023-7095](https://insights.sbomify.com/CVE-2023-7095/): Totolink A7100RU HTTP POST Request main buffer overflow (critical 9.8)
- [CVE-2023-7094](https://insights.sbomify.com/CVE-2023-7094/): Netentsec NS-ASG Application Security Gateway nsasg6.0.tgz information disclosure (medium 5.3)
- [CVE-2023-7093](https://insights.sbomify.com/CVE-2023-7093/): KylinSoft kylin-system-updater com.kylin.systemupgrade Service UpgradeStrategiesDbus.py os command injection (medium 5.3)
- [CVE-2023-7092](https://insights.sbomify.com/CVE-2023-7092/): Uniway UW-302VP Admin Web Interface wlan_basic_set.cgi cross-site request forgery (medium 4.3)
- [CVE-2023-7091](https://insights.sbomify.com/CVE-2023-7091/): Dreamer CMS uploadFile unrestricted upload (medium 6.3)
- [CVE-2023-7090](https://insights.sbomify.com/CVE-2023-7090/): Sudo: improper handling of ipa_hostname leads to privilege mismanagement (medium 6.6)
- [CVE-2023-7089](https://insights.sbomify.com/CVE-2023-7089/): Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2023-7088](https://insights.sbomify.com/CVE-2023-7088/): Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2023-7086](https://insights.sbomify.com/CVE-2023-7086/): SVG Uploads Support <= 2.1.1 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2023-7085](https://insights.sbomify.com/CVE-2023-7085/): Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2023-7084](https://insights.sbomify.com/CVE-2023-7084/): Voting Record <= 2.0 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-7083](https://insights.sbomify.com/CVE-2023-7083/): Voting Record <= 2.0 - Settings Update to Stored XSS via CSRF (medium 5.4)
- [CVE-2023-7082](https://insights.sbomify.com/CVE-2023-7082/): WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE (high 7.2)
- [CVE-2023-7081](https://insights.sbomify.com/CVE-2023-7081/): SQLi in PosTahsil's Online Payment System (critical 9.8)
- [CVE-2023-7080](https://insights.sbomify.com/CVE-2023-7080/): Arbitrary remote code execution within wrangler dev Workers sandbox (high 8.5)
- [CVE-2023-7079](https://insights.sbomify.com/CVE-2023-7079/): Arbitrary remote file read in Wrangler dev server (medium 6.4)
- [CVE-2023-7078](https://insights.sbomify.com/CVE-2023-7078/): Server-Side Request Forgery (SSRF) in Miniflare (high 7.5)
- [CVE-2023-7077](https://insights.sbomify.com/CVE-2023-7077/): Path traversal in P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8 (critical 9.8)
- [CVE-2023-7076](https://insights.sbomify.com/CVE-2023-7076/): slawkens MyAAC bugtracker.php cross site scripting (low 3.5)
- [CVE-2023-7075](https://insights.sbomify.com/CVE-2023-7075/): code-projects Point of Sales and Inventory Management System checkout.php cross site scripting (low 3.5)
- [CVE-2023-7074](https://insights.sbomify.com/CVE-2023-7074/): WP Social Bookmark Menu <= 1.2 - Settings Update via CSRF (high 8.8)
- [CVE-2023-7073](https://insights.sbomify.com/CVE-2023-7073/): Auto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery (medium 6.4)
- [CVE-2023-7072](https://insights.sbomify.com/CVE-2023-7072/): Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint (high 7.5)
- [CVE-2023-7071](https://insights.sbomify.com/CVE-2023-7071/): Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (medium 6.4)
- [CVE-2023-7070](https://insights.sbomify.com/CVE-2023-7070/): Cross-site scripting in Email Encoder – Protect Email Addresses and Phone Numbers (medium 6.4)
- [CVE-2023-7069](https://insights.sbomify.com/CVE-2023-7069/): Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-7068](https://insights.sbomify.com/CVE-2023-7068/): Missing authorization in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels (medium 4.3)
- [CVE-2023-7067](https://insights.sbomify.com/CVE-2023-7067/): ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store (medium 4.3)
- [CVE-2023-7066](https://insights.sbomify.com/CVE-2023-7066/): Siemens Teamcenter Visualization and JT2Go Out-of-bounds Read (high 7.3)
- [CVE-2023-7065](https://insights.sbomify.com/CVE-2023-7065/): Cross-site request forgery in Stop Spammers Classic (medium 5.4)
- [CVE-2023-7064](https://insights.sbomify.com/CVE-2023-7064/): Deserialization in Shortcodes and extra features for Phlox theme (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/125/