# Vulnerabilities published in 2023


- [CVE-2023-7063](https://insights.sbomify.com/CVE-2023-7063/): Cross-site scripting in WPForms Pro (high 7.2)
- [CVE-2023-7062](https://insights.sbomify.com/CVE-2023-7062/): Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal (high 8.8)
- [CVE-2023-7061](https://insights.sbomify.com/CVE-2023-7061/): Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2023-7060](https://insights.sbomify.com/CVE-2023-7060/): Missing Security Control in Zephyr OS IP Packet Handling (high 8.6)
- [CVE-2023-7059](https://insights.sbomify.com/CVE-2023-7059/): SourceCodester School Visitor Log e-Book log-book.php cross site scripting (low 3.5)
- [CVE-2023-7058](https://insights.sbomify.com/CVE-2023-7058/): SourceCodester Simple Student Attendance System path traversal (medium 6.3)
- [CVE-2023-7057](https://insights.sbomify.com/CVE-2023-7057/): code-projects Faculty Management System yearlevel.php cross site scripting (low 3.5)
- [CVE-2023-7056](https://insights.sbomify.com/CVE-2023-7056/): code-projects Faculty Management System subjects.php cross site scripting (low 2.4)
- [CVE-2023-7055](https://insights.sbomify.com/CVE-2023-7055/): PHPGurukul Online Notes Sharing System Contact Information profile.php access control (medium 4.3)
- [CVE-2023-7054](https://insights.sbomify.com/CVE-2023-7054/): PHPGurukul Online Notes Sharing System add-notes.php unrestricted upload (medium 5.5)
- [CVE-2023-7053](https://insights.sbomify.com/CVE-2023-7053/): PHPGurukul Online Notes Sharing System signup.php weak password (low 3.1)
- [CVE-2023-7052](https://insights.sbomify.com/CVE-2023-7052/): PHPGurukul Online Notes Sharing System profile.php cross-site request forgery (medium 4.3)
- [CVE-2023-7051](https://insights.sbomify.com/CVE-2023-7051/): PHPGurukul Online Notes Sharing System manage-notes.php cross-site request forgery (medium 4.3)
- [CVE-2023-7050](https://insights.sbomify.com/CVE-2023-7050/): PHPGurukul Online Notes Sharing System profile.php cross site scripting (low 3.5)
- [CVE-2023-7049](https://insights.sbomify.com/CVE-2023-7049/): Missing authorization in Custom Field For WP Job Manager (medium 4.3)
- [CVE-2023-7048](https://insights.sbomify.com/CVE-2023-7048/): My Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure (low 3.1)
- [CVE-2023-7047](https://insights.sbomify.com/CVE-2023-7047/): Missing authorization in Remote Desktop Manager (medium 4.4)
- [CVE-2023-7046](https://insights.sbomify.com/CVE-2023-7046/): Information disclosure in WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan (high 7.5)
- [CVE-2023-7045](https://insights.sbomify.com/CVE-2023-7045/): Cross-Site Request Forgery (CSRF) in GitLab (medium 5.4)
- [CVE-2023-7044](https://insights.sbomify.com/CVE-2023-7044/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2023-7043](https://insights.sbomify.com/CVE-2023-7043/): Unquoted path privilege vulnerability in ESET products for Windows (low 3.3)
- [CVE-2023-7042](https://insights.sbomify.com/CVE-2023-7042/): Kernel: null pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (medium 4.4)
- [CVE-2023-7041](https://insights.sbomify.com/CVE-2023-7041/): codelyfe Stupid Simple CMS rename.php path traversal (medium 5.4)
- [CVE-2023-7040](https://insights.sbomify.com/CVE-2023-7040/): codelyfe Stupid Simple CMS rename.php path traversal (medium 4.3)
- [CVE-2023-7039](https://insights.sbomify.com/CVE-2023-7039/): Byzoro S210 importexport.php injection (medium 6.3)
- [CVE-2023-7038](https://insights.sbomify.com/CVE-2023-7038/): automad User Creation cross-site request forgery (medium 4.3)
- [CVE-2023-7037](https://insights.sbomify.com/CVE-2023-7037/): automad FileController.php import server-side request forgery (medium 6.3)
- [CVE-2023-7036](https://insights.sbomify.com/CVE-2023-7036/): automad Content Type FileCollectionController.php upload unrestricted upload (medium 4.7)
- [CVE-2023-7035](https://insights.sbomify.com/CVE-2023-7035/): automad Setting post.php cross site scripting (medium 4.8)
- [CVE-2023-7033](https://insights.sbomify.com/CVE-2023-7033/): Denial of service in CC-Link IE TSN - AnyWireASLINK Bridge Module NZ2AW1GNAL (medium 5.3)
- [CVE-2023-7032](https://insights.sbomify.com/CVE-2023-7032/): Deserialization in Easergy Studio (high 7.8)
- [CVE-2023-7031](https://insights.sbomify.com/CVE-2023-7031/): Avaya Experience Portal Manager Insecure Direct Object Reference Vulnerabilities (medium 5.7)
- [CVE-2023-7030](https://insights.sbomify.com/CVE-2023-7030/): Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-7029](https://insights.sbomify.com/CVE-2023-7029/): WordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (medium 6.4)
- [CVE-2023-7028](https://insights.sbomify.com/CVE-2023-7028/): GitLab Community and Enterprise Editions Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2023-7027](https://insights.sbomify.com/CVE-2023-7027/): Cross-site scripting in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App (high 7.2)
- [CVE-2023-7026](https://insights.sbomify.com/CVE-2023-7026/): Lightxun IPTV Gateway web_upload_template.html unrestricted upload (medium 4.3)
- [CVE-2023-7025](https://insights.sbomify.com/CVE-2023-7025/): KylinSoft hedron-domain-hook DBus init_kcm access control (high 7.8)
- [CVE-2023-7024](https://insights.sbomify.com/CVE-2023-7024/): Google Chromium WebRTC Heap Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2023-7023](https://insights.sbomify.com/CVE-2023-7023/): Tongda OA 2017 delete.php sql injection (medium 6.3)
- [CVE-2023-7022](https://insights.sbomify.com/CVE-2023-7022/): Tongda OA 2017 delete_all.php sql injection (medium 6.3)
- [CVE-2023-7021](https://insights.sbomify.com/CVE-2023-7021/): Tongda OA 2017 delete_search.php sql injection (medium 6.3)
- [CVE-2023-7020](https://insights.sbomify.com/CVE-2023-7020/): Tongda OA 2017 view.php sql injection (medium 6.3)
- [CVE-2023-7019](https://insights.sbomify.com/CVE-2023-7019/): LightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing Authorization (medium 4.3)
- [CVE-2023-7018](https://insights.sbomify.com/CVE-2023-7018/): Deserialization of Untrusted Data in huggingface/transformers (critical 9.6)
- [CVE-2023-7017](https://insights.sbomify.com/CVE-2023-7017/): CVE-2023-7017 (critical 9.8)
- [CVE-2023-7016](https://insights.sbomify.com/CVE-2023-7016/): Privilege Escalation in SafeNet Authentication Client (high 7.8)
- [CVE-2023-7015](https://insights.sbomify.com/CVE-2023-7015/): File Manager Pro <= 8.3.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-7014](https://insights.sbomify.com/CVE-2023-7014/): Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug (medium 5.3)
- [CVE-2023-7013](https://insights.sbomify.com/CVE-2023-7013/): Other in Chrome (medium 5.4)
- [CVE-2023-7012](https://insights.sbomify.com/CVE-2023-7012/): Security feature bypass in Chrome (high 7.5)
- [CVE-2023-7011](https://insights.sbomify.com/CVE-2023-7011/): Other in Chrome (medium 6.5)
- [CVE-2023-7010](https://insights.sbomify.com/CVE-2023-7010/): Use after free in Chrome (high 8.8)
- [CVE-2023-7009](https://insights.sbomify.com/CVE-2023-7009/): CVE-2023-7009 (high 8.2)
- [CVE-2023-7008](https://insights.sbomify.com/CVE-2023-7008/): Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes (medium 5.9)
- [CVE-2023-7007](https://insights.sbomify.com/CVE-2023-7007/): CVE-2023-7007 (high 8.2)
- [CVE-2023-7006](https://insights.sbomify.com/CVE-2023-7006/): CVE-2023-7006 (critical 9.1)
- [CVE-2023-7005](https://insights.sbomify.com/CVE-2023-7005/): CVE-2023-7005 (high 7.5)
- [CVE-2023-7004](https://insights.sbomify.com/CVE-2023-7004/): CVE-2023-7004 (medium 6.5)
- [CVE-2023-7003](https://insights.sbomify.com/CVE-2023-7003/): CVE-2023-7003 (medium 6.8)
- [CVE-2023-7002](https://insights.sbomify.com/CVE-2023-7002/): Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url (high 7.2)
- [CVE-2023-6999](https://insights.sbomify.com/CVE-2023-6999/): Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution (high 8.8)
- [CVE-2023-6998](https://insights.sbomify.com/CVE-2023-6998/): Lockscreen bypass in eWeLink App (high 7.7)
- [CVE-2023-6996](https://insights.sbomify.com/CVE-2023-6996/): Code injection in Display custom fields in the frontend – Post and User Profile Fields (high 8.8)
- [CVE-2023-6994](https://insights.sbomify.com/CVE-2023-6994/): List category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6993](https://insights.sbomify.com/CVE-2023-6993/): Custom post types, Custom Fields & more <= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-6992](https://insights.sbomify.com/CVE-2023-6992/): Memory corruption issues is Cloudflare zlib implementation (medium 4.0)
- [CVE-2023-6991](https://insights.sbomify.com/CVE-2023-6991/): JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF (high 8.8)
- [CVE-2023-6990](https://insights.sbomify.com/CVE-2023-6990/): Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-6989](https://insights.sbomify.com/CVE-2023-6989/): Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2023-6988](https://insights.sbomify.com/CVE-2023-6988/): Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6987](https://insights.sbomify.com/CVE-2023-6987/): String Locator <= 2.6.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6986](https://insights.sbomify.com/CVE-2023-6986/): Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 6.4)
- [CVE-2023-6985](https://insights.sbomify.com/CVE-2023-6985/): 10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation (medium 6.5)
- [CVE-2023-6984](https://insights.sbomify.com/CVE-2023-6984/): PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.13 - Cross-Site Request Forgery (medium 5.3)
- [CVE-2023-6983](https://insights.sbomify.com/CVE-2023-6983/): Missing authorization in Display custom fields in the frontend – Post and User Profile Fields (medium 4.3)
- [CVE-2023-6982](https://insights.sbomify.com/CVE-2023-6982/): Cross-site scripting in Display custom fields in the frontend – Post and User Profile Fields (medium 6.4)
- [CVE-2023-6981](https://insights.sbomify.com/CVE-2023-6981/): WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6980](https://insights.sbomify.com/CVE-2023-6980/): WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion (medium 4.3)
- [CVE-2023-6979](https://insights.sbomify.com/CVE-2023-6979/): Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload (high 8.8)
- [CVE-2023-6978](https://insights.sbomify.com/CVE-2023-6978/): WP Job Manager – Company Profiles <= 1.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6977](https://insights.sbomify.com/CVE-2023-6977/): Path Traversal: '\..\filename' (critical 10.0)
- [CVE-2023-6976](https://insights.sbomify.com/CVE-2023-6976/): Unrestricted Upload of File with Dangerous Type (high 8.8)
- [CVE-2023-6975](https://insights.sbomify.com/CVE-2023-6975/): Path Traversal: '\..\filename' (critical 9.8)
- [CVE-2023-6974](https://insights.sbomify.com/CVE-2023-6974/): Server-Side Request Forgery (SSRF) (high 8.6)
- [CVE-2023-6972](https://insights.sbomify.com/CVE-2023-6972/): Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion (critical 9.8)
- [CVE-2023-6971](https://insights.sbomify.com/CVE-2023-6971/): Code injection in Backup Migration (high 8.1)
- [CVE-2023-6970](https://insights.sbomify.com/CVE-2023-6970/): WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer (medium 6.1)
- [CVE-2023-6969](https://insights.sbomify.com/CVE-2023-6969/): Missing authorization in User Shortcodes Plus (medium 4.3)
- [CVE-2023-6968](https://insights.sbomify.com/CVE-2023-6968/): The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions (high 8.1)
- [CVE-2023-6967](https://insights.sbomify.com/CVE-2023-6967/): Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-6966](https://insights.sbomify.com/CVE-2023-6966/): The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions (high 8.1)
- [CVE-2023-6965](https://insights.sbomify.com/CVE-2023-6965/): Pods - Custom Content Types and Fields - Missing Authorization (medium 4.3)
- [CVE-2023-6964](https://insights.sbomify.com/CVE-2023-6964/): Server-side request forgery in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (high 8.5)
- [CVE-2023-6963](https://insights.sbomify.com/CVE-2023-6963/): Getwid – Gutenberg Blocks <= 2.0.4 - Captcha Bypass (medium 5.3)
- [CVE-2023-6962](https://insights.sbomify.com/CVE-2023-6962/): WP Meta SEO <= 4.5.12 - Information Exposure via Meta Description (medium 5.3)
- [CVE-2023-6961](https://insights.sbomify.com/CVE-2023-6961/): WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header (high 7.2)
- [CVE-2023-6960](https://insights.sbomify.com/CVE-2023-6960/): CVE-2023-6960 (high 7.5)
- [CVE-2023-6959](https://insights.sbomify.com/CVE-2023-6959/): Getwid – Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification (medium 4.3)
- [CVE-2023-6958](https://insights.sbomify.com/CVE-2023-6958/): WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/126/