# Vulnerabilities published in 2023


- [CVE-2023-6502](https://insights.sbomify.com/CVE-2023-6502/): Inefficient Regular Expression Complexity in GitLab (medium 4.3)
- [CVE-2023-6501](https://insights.sbomify.com/CVE-2023-6501/): Splashscreen <= 0.20 - Settings Update via CSRF (medium 4.3)
- [CVE-2023-6500](https://insights.sbomify.com/CVE-2023-6500/): Shariff Wrapper <= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6499](https://insights.sbomify.com/CVE-2023-6499/): lasTunes <= 3.6.1 - Settings Update via CSRF (medium 5.4)
- [CVE-2023-6498](https://insights.sbomify.com/CVE-2023-6498/): Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings (medium 4.4)
- [CVE-2023-6497](https://insights.sbomify.com/CVE-2023-6497/): WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-6496](https://insights.sbomify.com/CVE-2023-6496/): Manage Notification E-mails <= 1.8.5 - Missing Authorization (medium 5.3)
- [CVE-2023-6495](https://insights.sbomify.com/CVE-2023-6495/): YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting (medium 4.4)
- [CVE-2023-6494](https://insights.sbomify.com/CVE-2023-6494/): WPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-6493](https://insights.sbomify.com/CVE-2023-6493/): Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save (medium 4.3)
- [CVE-2023-6492](https://insights.sbomify.com/CVE-2023-6492/): Simple Sitemap <= 3.5.13 - Cross-Site Request Forgery via admin_notices (medium 4.3)
- [CVE-2023-6491](https://insights.sbomify.com/CVE-2023-6491/): Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification (medium 4.3)
- [CVE-2023-6489](https://insights.sbomify.com/CVE-2023-6489/): Inefficient Regular Expression Complexity in GitLab (medium 4.3)
- [CVE-2023-6488](https://insights.sbomify.com/CVE-2023-6488/): WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-6487](https://insights.sbomify.com/CVE-2023-6487/): LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting (medium 4.4)
- [CVE-2023-6486](https://insights.sbomify.com/CVE-2023-6486/): Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS (medium 6.4)
- [CVE-2023-6485](https://insights.sbomify.com/CVE-2023-6485/): Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-6484](https://insights.sbomify.com/CVE-2023-6484/): Keycloak: log injection during webauthn authentication or registration (medium 5.3)
- [CVE-2023-6483](https://insights.sbomify.com/CVE-2023-6483/): Improper Authentication Vulnerability in ADiTaaS (critical 9.1)
- [CVE-2023-6482](https://insights.sbomify.com/CVE-2023-6482/): Encryption key derived from static host information (medium 5.2)
- [CVE-2023-6481](https://insights.sbomify.com/CVE-2023-6481/): Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix (high 7.1)
- [CVE-2023-6478](https://insights.sbomify.com/CVE-2023-6478/): Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty (high 7.6)
- [CVE-2023-6477](https://insights.sbomify.com/CVE-2023-6477/): Incorrect Privilege Assignment in GitLab (medium 6.7)
- [CVE-2023-6476](https://insights.sbomify.com/CVE-2023-6476/): Cri-o: pods are able to break out of resource confinement on cgroupv2 (medium 6.5)
- [CVE-2023-6474](https://insights.sbomify.com/CVE-2023-6474/): PHPGurukul Nipah Virus Testing Management System manage-phlebotomist.php cross-site request forgery (medium 4.3)
- [CVE-2023-6473](https://insights.sbomify.com/CVE-2023-6473/): SourceCodester Online Quiz System take-quiz.php cross site scripting (low 3.5)
- [CVE-2023-6472](https://insights.sbomify.com/CVE-2023-6472/): PHPEMS Content Section api.cls.php cross site scripting (low 2.4)
- [CVE-2023-6467](https://insights.sbomify.com/CVE-2023-6467/): Thecosy IceCMS Comment Like improper enforcement of a single, unique action (low 3.1)
- [CVE-2023-6466](https://insights.sbomify.com/CVE-2023-6466/): Thecosy IceCMS User Comment planet cross site scripting (low 3.5)
- [CVE-2023-6465](https://insights.sbomify.com/CVE-2023-6465/): PHPGurukul Nipah Virus Testing Management System registered-user-testing.php cross site scripting (medium 4.3)
- [CVE-2023-6464](https://insights.sbomify.com/CVE-2023-6464/): SourceCodester User Registration and Login System add-user.php sql injection (medium 6.3)
- [CVE-2023-6463](https://insights.sbomify.com/CVE-2023-6463/): SourceCodester User Registration and Login System add-user.php cross site scripting (low 3.5)
- [CVE-2023-6462](https://insights.sbomify.com/CVE-2023-6462/): SourceCodester User Registration and Login System delete-user.php cross site scripting (low 3.5)
- [CVE-2023-6461](https://insights.sbomify.com/CVE-2023-6461/): Cross-site Scripting (XSS) - Reflected in viliusle/minipaint (high 8.6)
- [CVE-2023-6460](https://insights.sbomify.com/CVE-2023-6460/): Information leak in nodejs-firestore (medium 4.0)
- [CVE-2023-6459](https://insights.sbomify.com/CVE-2023-6459/): Public endpoint /metrics of Calls plugin reveals channel IDs (medium 5.3)
- [CVE-2023-6458](https://insights.sbomify.com/CVE-2023-6458/): Client side path traversal due to lack of route parameters validation (high 7.1)
- [CVE-2023-6457](https://insights.sbomify.com/CVE-2023-6457/): File and Directory Permission Vulnerability in Hitachi Tuning Manager (medium 6.6)
- [CVE-2023-6456](https://insights.sbomify.com/CVE-2023-6456/): WP Review Slider < 13.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6452](https://insights.sbomify.com/CVE-2023-6452/): Cross-site scripting in Web Security (critical 9.6)
- [CVE-2023-6451](https://insights.sbomify.com/CVE-2023-6451/): Publicly Known Cryptographic Machine Key In Procura Portal Application (high 8.6)
- [CVE-2023-6450](https://insights.sbomify.com/CVE-2023-6450/): Denial of service in Lenovo App Store Application (medium 5.5)
- [CVE-2023-6449](https://insights.sbomify.com/CVE-2023-6449/): Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload (medium 6.6)
- [CVE-2023-6448](https://insights.sbomify.com/CVE-2023-6448/): Unitronics Vision PLC and HMI Insecure Default Password (critical 9.8, exploited in the wild)
- [CVE-2023-6447](https://insights.sbomify.com/CVE-2023-6447/): EventPrime < 3.3.6 - Unauthenticated Event Access (medium 5.3)
- [CVE-2023-6446](https://insights.sbomify.com/CVE-2023-6446/): Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-6444](https://insights.sbomify.com/CVE-2023-6444/): Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure (medium 5.3)
- [CVE-2023-6442](https://insights.sbomify.com/CVE-2023-6442/): PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php cross site scripting (low 3.5)
- [CVE-2023-6441](https://insights.sbomify.com/CVE-2023-6441/): SQLi in UNI-PA's University Information System (critical 9.8)
- [CVE-2023-6440](https://insights.sbomify.com/CVE-2023-6440/): SourceCodester Book Borrower System add-book.php cross site scripting (low 3.5)
- [CVE-2023-6439](https://insights.sbomify.com/CVE-2023-6439/): ZenTao PMS cross site scripting (low 3.5)
- [CVE-2023-6438](https://insights.sbomify.com/CVE-2023-6438/): Thecosy IceCMS Like improper enforcement of a single, unique action (medium 4.3)
- [CVE-2023-6437](https://insights.sbomify.com/CVE-2023-6437/): Authenticated RCE (critical 9.8)
- [CVE-2023-6436](https://insights.sbomify.com/CVE-2023-6436/): SQLi in Ekol Bilisim Website Template (critical 9.8)
- [CVE-2023-6435](https://insights.sbomify.com/CVE-2023-6435/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6434](https://insights.sbomify.com/CVE-2023-6434/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6433](https://insights.sbomify.com/CVE-2023-6433/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6432](https://insights.sbomify.com/CVE-2023-6432/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6431](https://insights.sbomify.com/CVE-2023-6431/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6430](https://insights.sbomify.com/CVE-2023-6430/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6429](https://insights.sbomify.com/CVE-2023-6429/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6428](https://insights.sbomify.com/CVE-2023-6428/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6427](https://insights.sbomify.com/CVE-2023-6427/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6426](https://insights.sbomify.com/CVE-2023-6426/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6425](https://insights.sbomify.com/CVE-2023-6425/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6424](https://insights.sbomify.com/CVE-2023-6424/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6423](https://insights.sbomify.com/CVE-2023-6423/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6422](https://insights.sbomify.com/CVE-2023-6422/): Cross-site Scripting vulnerability in BigProf products (medium 6.3)
- [CVE-2023-6421](https://insights.sbomify.com/CVE-2023-6421/): Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak (high 7.5)
- [CVE-2023-6420](https://insights.sbomify.com/CVE-2023-6420/): Cross-site Scripting vulnerability in Voovi Social Networking Script (medium 6.5)
- [CVE-2023-6419](https://insights.sbomify.com/CVE-2023-6419/): Cross-site Scripting vulnerability in Voovi Social Networking Script (medium 6.5)
- [CVE-2023-6418](https://insights.sbomify.com/CVE-2023-6418/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6417](https://insights.sbomify.com/CVE-2023-6417/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6416](https://insights.sbomify.com/CVE-2023-6416/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6415](https://insights.sbomify.com/CVE-2023-6415/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6414](https://insights.sbomify.com/CVE-2023-6414/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6413](https://insights.sbomify.com/CVE-2023-6413/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6412](https://insights.sbomify.com/CVE-2023-6412/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6411](https://insights.sbomify.com/CVE-2023-6411/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6410](https://insights.sbomify.com/CVE-2023-6410/): SQL injection in Voovi Social Networking Script (critical 9.8)
- [CVE-2023-6409](https://insights.sbomify.com/CVE-2023-6409/): Hardcoded credentials in EcoStruxure Control Expert (high 7.7)
- [CVE-2023-6408](https://insights.sbomify.com/CVE-2023-6408/): Other in EcoStruxure Control Expert (high 8.1)
- [CVE-2023-6407](https://insights.sbomify.com/CVE-2023-6407/): Path traversal in Easy UPS Online Monitoring Software (medium 5.3)
- [CVE-2023-6402](https://insights.sbomify.com/CVE-2023-6402/): PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php sql injection (medium 6.3)
- [CVE-2023-6401](https://insights.sbomify.com/CVE-2023-6401/): NotePad++ dbghelp.exe uncontrolled search path (medium 5.3)
- [CVE-2023-6400](https://insights.sbomify.com/CVE-2023-6400/): Incorrect user authorization vulnerability on OpenText ZENworks Configuration Management (ZCM) product. (high 7.4)
- [CVE-2023-6399](https://insights.sbomify.com/CVE-2023-6399/): Denial of service in USG FLEX 50(W) series firmware (medium 5.7)
- [CVE-2023-6398](https://insights.sbomify.com/CVE-2023-6398/): Command injection in NWA50AX firmware (high 7.2)
- [CVE-2023-6397](https://insights.sbomify.com/CVE-2023-6397/): Null dereference in ATP series firmware (medium 6.5)
- [CVE-2023-6395](https://insights.sbomify.com/CVE-2023-6395/): Mock: privilege escalation for users that can access mock configuration (medium 6.7)
- [CVE-2023-6394](https://insights.sbomify.com/CVE-2023-6394/): Quarkus: graphql operations over websockets bypass (high 7.4)
- [CVE-2023-6393](https://insights.sbomify.com/CVE-2023-6393/): Quarkus: potential invalid reuse of context when @cacheresult on a uni is used (medium 5.3)
- [CVE-2023-6391](https://insights.sbomify.com/CVE-2023-6391/): Custom User CSS <= 0.2 - Settings Update via CSRF (high 8.8)
- [CVE-2023-6390](https://insights.sbomify.com/CVE-2023-6390/): WordPress Users <= 1.4 - Settings Update via CSRF (high 8.8)
- [CVE-2023-6389](https://insights.sbomify.com/CVE-2023-6389/): WordPress Toolbar <= 2.2.6 - Open Redirect (medium 6.1)
- [CVE-2023-6388](https://insights.sbomify.com/CVE-2023-6388/): Suite CRM v7.14.2 - SSRF (medium 5.0)
- [CVE-2023-6387](https://insights.sbomify.com/CVE-2023-6387/): Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow (high 7.5)
- [CVE-2023-6386](https://insights.sbomify.com/CVE-2023-6386/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2023-6385](https://insights.sbomify.com/CVE-2023-6385/): WordPress Ping Optimizer <= 2.35.1.3.0 - Log Clearing via CSRF (medium 4.3)
- [CVE-2023-6384](https://insights.sbomify.com/CVE-2023-6384/): WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/131/