# Vulnerabilities published in 2023


- [CVE-2023-5927](https://insights.sbomify.com/CVE-2023-5927/): Campcodes Simple Student Information System manage_course.php sql injection (medium 5.5)
- [CVE-2023-5926](https://insights.sbomify.com/CVE-2023-5926/): Campcodes Simple Student Information System update_status.php sql injection (medium 5.5)
- [CVE-2023-5925](https://insights.sbomify.com/CVE-2023-5925/): Campcodes Simple Student Information System Master.php sql injection (medium 5.5)
- [CVE-2023-5924](https://insights.sbomify.com/CVE-2023-5924/): Campcodes Simple Student Information System view_course.php sql injection (medium 5.5)
- [CVE-2023-5923](https://insights.sbomify.com/CVE-2023-5923/): Campcodes Simple Student Information System index.php sql injection (medium 5.5)
- [CVE-2023-5922](https://insights.sbomify.com/CVE-2023-5922/): Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read (high 7.5)
- [CVE-2023-5921](https://insights.sbomify.com/CVE-2023-5921/): Function Bypass in Geodi (high 7.1)
- [CVE-2023-5920](https://insights.sbomify.com/CVE-2023-5920/): Lack Of Secure Keyboard Entry Protection in MacOS Desktop (low 2.9)
- [CVE-2023-5919](https://insights.sbomify.com/CVE-2023-5919/): SourceCodester Company Website CMS Create Blog Page createblog unrestricted upload (medium 4.7)
- [CVE-2023-5918](https://insights.sbomify.com/CVE-2023-5918/): SourceCodester Visitor Management System manage_user.php sql injection (medium 6.3)
- [CVE-2023-5917](https://insights.sbomify.com/CVE-2023-5917/): phpBB Smiley Pack acp_icons.php main cross site scripting (low 2.4)
- [CVE-2023-5916](https://insights.sbomify.com/CVE-2023-5916/): Lissy93 Dashy Configuration save access control (medium 4.3)
- [CVE-2023-5915](https://insights.sbomify.com/CVE-2023-5915/): Denial of service in STARDOM (medium 5.3)
- [CVE-2023-5914](https://insights.sbomify.com/CVE-2023-5914/): Cross-site scripting (XSS) (medium 5.4)
- [CVE-2023-5913](https://insights.sbomify.com/CVE-2023-5913/): A potential Privilege Escalation vulnerability in opentext Fortify ScanCentral DAST API. (high 8.2)
- [CVE-2023-5912](https://insights.sbomify.com/CVE-2023-5912/): Memory corruption in Notebook BIOS (medium 6.7)
- [CVE-2023-5911](https://insights.sbomify.com/CVE-2023-5911/): WP Custom Cursors <= 3.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-5910](https://insights.sbomify.com/CVE-2023-5910/): PopojiCMS Web Config install.php cross site scripting (low 2.6)
- [CVE-2023-5909](https://insights.sbomify.com/CVE-2023-5909/): Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx (high 7.5)
- [CVE-2023-5908](https://insights.sbomify.com/CVE-2023-5908/): Heap Based Buffer Overflow in PTC KEPServerEx (critical 9.1)
- [CVE-2023-5907](https://insights.sbomify.com/CVE-2023-5907/): File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal (medium 6.5)
- [CVE-2023-5906](https://insights.sbomify.com/CVE-2023-5906/): Job Manager & Career < 1.4.4 - Directory listing to Sensitive Data Exposure (high 7.5)
- [CVE-2023-5905](https://insights.sbomify.com/CVE-2023-5905/): DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export (high 8.1)
- [CVE-2023-5904](https://insights.sbomify.com/CVE-2023-5904/): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (low 2.7)
- [CVE-2023-5903](https://insights.sbomify.com/CVE-2023-5903/): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (low 2.7)
- [CVE-2023-5902](https://insights.sbomify.com/CVE-2023-5902/): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (medium 4.3)
- [CVE-2023-5901](https://insights.sbomify.com/CVE-2023-5901/): Cross-site Scripting in pkp/pkp-lib (low 3.5)
- [CVE-2023-5900](https://insights.sbomify.com/CVE-2023-5900/): Cross-Site Request Forgery in pkp/pkp-lib (low 3.5)
- [CVE-2023-5899](https://insights.sbomify.com/CVE-2023-5899/): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (low 3.5)
- [CVE-2023-5898](https://insights.sbomify.com/CVE-2023-5898/): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (low 3.5)
- [CVE-2023-5897](https://insights.sbomify.com/CVE-2023-5897/): Cross-Site Request Forgery (CSRF) in pkp/customLocale (medium 6.3)
- [CVE-2023-5896](https://insights.sbomify.com/CVE-2023-5896/): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (low 2.7)
- [CVE-2023-5895](https://insights.sbomify.com/CVE-2023-5895/): Cross-site Scripting (XSS) - DOM in pkp/pkp-lib (low 3.5)
- [CVE-2023-5894](https://insights.sbomify.com/CVE-2023-5894/): Cross-site Scripting (XSS) - Stored in pkp/ojs (low 3.5)
- [CVE-2023-5893](https://insights.sbomify.com/CVE-2023-5893/): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (low 3.5)
- [CVE-2023-5892](https://insights.sbomify.com/CVE-2023-5892/): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (medium 5.4)
- [CVE-2023-5891](https://insights.sbomify.com/CVE-2023-5891/): Cross-site Scripting (XSS) - Reflected in pkp/pkp-lib (medium 5.4)
- [CVE-2023-5890](https://insights.sbomify.com/CVE-2023-5890/): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (medium 4.6)
- [CVE-2023-5889](https://insights.sbomify.com/CVE-2023-5889/): Insufficient Session Expiration in pkp/pkp-lib (medium 4.3)
- [CVE-2023-5886](https://insights.sbomify.com/CVE-2023-5886/): WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF (high 8.8)
- [CVE-2023-5885](https://insights.sbomify.com/CVE-2023-5885/): Franklin Electric Fueling Systems Colibri Path Traversal (medium 6.5)
- [CVE-2023-5884](https://insights.sbomify.com/CVE-2023-5884/): Word Balloon < 4.20.3 - Avatar Removal via CSRF (medium 6.5)
- [CVE-2023-5882](https://insights.sbomify.com/CVE-2023-5882/): WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF (high 8.8)
- [CVE-2023-5881](https://insights.sbomify.com/CVE-2023-5881/): Unauthenticated access permitted to web interface page "Garage Door Control Module Setup" (high 7.1)
- [CVE-2023-5880](https://insights.sbomify.com/CVE-2023-5880/): Cross-site scripting in Aladdin Connect (Retrofit-Kit) (high 8.8)
- [CVE-2023-5879](https://insights.sbomify.com/CVE-2023-5879/): Aladdin Connect Android Application Insecure Storage (medium 6.8)
- [CVE-2023-5878](https://insights.sbomify.com/CVE-2023-5878/): OneWireless command injection possible when updating firmware (critical 9.4)
- [CVE-2023-5877](https://insights.sbomify.com/CVE-2023-5877/): affiliate-toolkit < 3.4.3 - Unauthenticated SSRF (critical 9.8)
- [CVE-2023-5876](https://insights.sbomify.com/CVE-2023-5876/): Regex DoS from a malicious server enrolled in Desktop (low 3.1)
- [CVE-2023-5875](https://insights.sbomify.com/CVE-2023-5875/): Lack of Hardening against media exploitation from a remote origin (low 3.7)
- [CVE-2023-5874](https://insights.sbomify.com/CVE-2023-5874/): Popup box < 3.8.6 - Admin+ Stored XSS in Popup Settings (medium 4.8)
- [CVE-2023-5873](https://insights.sbomify.com/CVE-2023-5873/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.0)
- [CVE-2023-5872](https://insights.sbomify.com/CVE-2023-5872/): Wago: Vulnerability in Smart Designer Web-Application (medium 4.3)
- [CVE-2023-5871](https://insights.sbomify.com/CVE-2023-5871/): Libnbd: malicious nbd server may crash libnbd (medium 5.3)
- [CVE-2023-5870](https://insights.sbomify.com/CVE-2023-5870/): Postgresql: role pg_signal_backend can signal certain superuser processes. (low 2.2)
- [CVE-2023-5869](https://insights.sbomify.com/CVE-2023-5869/): Postgresql: buffer overrun from integer overflow in array modification (high 8.8)
- [CVE-2023-5868](https://insights.sbomify.com/CVE-2023-5868/): Postgresql: memory disclosure in aggregate function calls (medium 4.3)
- [CVE-2023-5867](https://insights.sbomify.com/CVE-2023-5867/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 4.6)
- [CVE-2023-5866](https://insights.sbomify.com/CVE-2023-5866/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq (medium 6.3)
- [CVE-2023-5865](https://insights.sbomify.com/CVE-2023-5865/): Insufficient Session Expiration in thorsten/phpmyfaq (high 7.6)
- [CVE-2023-5864](https://insights.sbomify.com/CVE-2023-5864/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 7.4)
- [CVE-2023-5863](https://insights.sbomify.com/CVE-2023-5863/): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (high 7.4)
- [CVE-2023-5862](https://insights.sbomify.com/CVE-2023-5862/): Missing Authorization in hamza417/inure (medium 5.1)
- [CVE-2023-5861](https://insights.sbomify.com/CVE-2023-5861/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 6.4)
- [CVE-2023-5860](https://insights.sbomify.com/CVE-2023-5860/): Icons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2023-5859](https://insights.sbomify.com/CVE-2023-5859/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5858](https://insights.sbomify.com/CVE-2023-5858/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5857](https://insights.sbomify.com/CVE-2023-5857/): Other in Chrome (high 8.8)
- [CVE-2023-5856](https://insights.sbomify.com/CVE-2023-5856/): Use after free in Chrome (high 8.8)
- [CVE-2023-5855](https://insights.sbomify.com/CVE-2023-5855/): Use after free in Chrome (high 8.8)
- [CVE-2023-5854](https://insights.sbomify.com/CVE-2023-5854/): Use after free in Chrome (high 8.8)
- [CVE-2023-5853](https://insights.sbomify.com/CVE-2023-5853/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5852](https://insights.sbomify.com/CVE-2023-5852/): Use after free in Chrome (high 8.8)
- [CVE-2023-5851](https://insights.sbomify.com/CVE-2023-5851/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5850](https://insights.sbomify.com/CVE-2023-5850/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5849](https://insights.sbomify.com/CVE-2023-5849/): Integer overflow in Chrome (high 8.8)
- [CVE-2023-5847](https://insights.sbomify.com/CVE-2023-5847/): Privilege escalation in Nessus (medium 6.7)
- [CVE-2023-5846](https://insights.sbomify.com/CVE-2023-5846/): Use of Password Hash With Insufficient Computational Effort in Franklin Fueling System TS-550 (high 8.3)
- [CVE-2023-5845](https://insights.sbomify.com/CVE-2023-5845/): Simple Social Buttons < 5.1.1 - Unauthenticated Password Protected Post Access (medium 5.3)
- [CVE-2023-5844](https://insights.sbomify.com/CVE-2023-5844/): Unverified Password Change in pimcore/admin-ui-classic-bundle (medium 4.3)
- [CVE-2023-5843](https://insights.sbomify.com/CVE-2023-5843/): Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution (critical 9.0)
- [CVE-2023-5842](https://insights.sbomify.com/CVE-2023-5842/): Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr (medium 4.8)
- [CVE-2023-5841](https://insights.sbomify.com/CVE-2023-5841/): OpenEXR Heap Overflow in Scanline Deep Data Parsing (critical 9.1)
- [CVE-2023-5840](https://insights.sbomify.com/CVE-2023-5840/): Weak Password Recovery Mechanism for Forgotten Password in linkstackorg/linkstack (medium 6.5)
- [CVE-2023-5839](https://insights.sbomify.com/CVE-2023-5839/): Privilege Chaining in hestiacp/hestiacp (high 8.8)
- [CVE-2023-5838](https://insights.sbomify.com/CVE-2023-5838/): Insufficient Session Expiration in linkstackorg/linkstack (medium 4.1)
- [CVE-2023-5837](https://insights.sbomify.com/CVE-2023-5837/): AlexanderLivanov FotosCMS2 Cookie profile.php cross site scripting (low 3.5)
- [CVE-2023-5836](https://insights.sbomify.com/CVE-2023-5836/): SourceCodester Task Reminder System sql injection (medium 6.3)
- [CVE-2023-5835](https://insights.sbomify.com/CVE-2023-5835/): hu60t hu60wap6 ubbparser.php markdown cross site scripting (low 3.5)
- [CVE-2023-5834](https://insights.sbomify.com/CVE-2023-5834/): Vagrant’s Windows Installer Allowed Directory Junction Write (low 3.8)
- [CVE-2023-5833](https://insights.sbomify.com/CVE-2023-5833/): Improper Access Control in mintplex-labs/anything-llm (high 8.1)
- [CVE-2023-5832](https://insights.sbomify.com/CVE-2023-5832/): Improper Input Validation in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2023-5831](https://insights.sbomify.com/CVE-2023-5831/): Insertion of Sensitive Information Into Sent Data in GitLab (low 3.7)
- [CVE-2023-5830](https://insights.sbomify.com/CVE-2023-5830/): ColumbiaSoft Document Locator WebTools login improper authentication (high 7.3)
- [CVE-2023-5829](https://insights.sbomify.com/CVE-2023-5829/): code-projects Admission Management System student_avatar.php unrestricted upload (medium 6.3)
- [CVE-2023-5828](https://insights.sbomify.com/CVE-2023-5828/): SQL injection in Longxing Industrial Development Zone Project Construction and Installation Management System (high 7.3)
- [CVE-2023-5827](https://insights.sbomify.com/CVE-2023-5827/): Shanghai CTI Navigation CTI Monitoring and Early Warning System UserEdit.aspx sql injection (medium 5.5)
- [CVE-2023-5826](https://insights.sbomify.com/CVE-2023-5826/): Netentsec NS-ASG Application Security Gateway list_onlineuser.php sql injection (medium 5.5)
- [CVE-2023-5825](https://insights.sbomify.com/CVE-2023-5825/): Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab (medium 6.5)
- [CVE-2023-5824](https://insights.sbomify.com/CVE-2023-5824/): Squid: dos against http and https (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/136/