# Vulnerabilities published in 2023


- [CVE-2023-5823](https://insights.sbomify.com/CVE-2023-5823/): WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-5822](https://insights.sbomify.com/CVE-2023-5822/): Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload (high 8.1)
- [CVE-2023-5821](https://insights.sbomify.com/CVE-2023-5821/): Cross-site request forgery in Thumbnail carousel slider (medium 4.3)
- [CVE-2023-5820](https://insights.sbomify.com/CVE-2023-5820/): Cross-site request forgery in Thumbnail Slider With Lightbox (critical 9.6)
- [CVE-2023-5819](https://insights.sbomify.com/CVE-2023-5819/): Amazonify <= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-5818](https://insights.sbomify.com/CVE-2023-5818/): Amazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update (medium 4.3)
- [CVE-2023-5817](https://insights.sbomify.com/CVE-2023-5817/): Neon text <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-5816](https://insights.sbomify.com/CVE-2023-5816/): Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading (medium 4.9)
- [CVE-2023-5815](https://insights.sbomify.com/CVE-2023-5815/): Code injection in Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News (high 8.1)
- [CVE-2023-5814](https://insights.sbomify.com/CVE-2023-5814/): SourceCodester Task Reminder System sql injection (medium 6.3)
- [CVE-2023-5813](https://insights.sbomify.com/CVE-2023-5813/): SourceCodester Task Reminder System sql injection (medium 6.3)
- [CVE-2023-5812](https://insights.sbomify.com/CVE-2023-5812/): flusity CMS upload.php handleFileUpload unrestricted upload (medium 4.7)
- [CVE-2023-5811](https://insights.sbomify.com/CVE-2023-5811/): flusity CMS posts.php loadPostAddForm cross site scripting (low 2.4)
- [CVE-2023-5810](https://insights.sbomify.com/CVE-2023-5810/): flusity CMS posts.php loadPostAddForm cross site scripting (low 2.4)
- [CVE-2023-5809](https://insights.sbomify.com/CVE-2023-5809/): Popup box < 3.8.6 - Admin+ Stored XSS in Categories (medium 4.8)
- [CVE-2023-5808](https://insights.sbomify.com/CVE-2023-5808/): Missing authorization in System Management Unit (SMU) (high 7.6)
- [CVE-2023-5807](https://insights.sbomify.com/CVE-2023-5807/): SQLi in TRtek Software's Education Portal (critical 9.8)
- [CVE-2023-5806](https://insights.sbomify.com/CVE-2023-5806/): SQLi in Mergen Soft Quality Management System (critical 9.8)
- [CVE-2023-5805](https://insights.sbomify.com/CVE-2023-5805/): SourceCodester Simple Real Estate Portal System view_estate.php sql injection (medium 6.3)
- [CVE-2023-5804](https://insights.sbomify.com/CVE-2023-5804/): PHPGurukul Nipah Virus Testing Management System login.php sql injection (high 7.3)
- [CVE-2023-5803](https://insights.sbomify.com/CVE-2023-5803/): WordPress Business Directory Plugin Plugin <= 6.3.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-5802](https://insights.sbomify.com/CVE-2023-5802/): WordPress WP Knowledgebase Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-5801](https://insights.sbomify.com/CVE-2023-5801/): Auth bypass in EMUI (critical 9.1)
- [CVE-2023-5800](https://insights.sbomify.com/CVE-2023-5800/): Insufficient input validation in VAPIX API create_overlay.cgi (medium 5.4)
- [CVE-2023-5799](https://insights.sbomify.com/CVE-2023-5799/): WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion (medium 5.4)
- [CVE-2023-5798](https://insights.sbomify.com/CVE-2023-5798/): Assistant < 1.4.4 - Editor+ SSRF (high 8.8)
- [CVE-2023-5797](https://insights.sbomify.com/CVE-2023-5797/): Privilege escalation in ATP series firmware (medium 5.5)
- [CVE-2023-5796](https://insights.sbomify.com/CVE-2023-5796/): CodeAstro POS System Logo setting unrestricted upload (medium 6.3)
- [CVE-2023-5795](https://insights.sbomify.com/CVE-2023-5795/): CodeAstro POS System Profile Picture profil unrestricted upload (medium 6.3)
- [CVE-2023-5794](https://insights.sbomify.com/CVE-2023-5794/): PHPGurukul Online Railway Catering System Login index.php sql injection (high 7.3)
- [CVE-2023-5793](https://insights.sbomify.com/CVE-2023-5793/): flusity CMS Dashboard customblock.php loadCustomBlocCreateForm cross site scripting (low 3.5)
- [CVE-2023-5792](https://insights.sbomify.com/CVE-2023-5792/): SourceCodester Sticky Notes App delete-note.php sql injection (medium 6.3)
- [CVE-2023-5791](https://insights.sbomify.com/CVE-2023-5791/): SourceCodester Sticky Notes App add-note.php cross site scripting (low 3.5)
- [CVE-2023-5790](https://insights.sbomify.com/CVE-2023-5790/): SourceCodester File Manager App add-file.php unrestricted upload (medium 6.3)
- [CVE-2023-5789](https://insights.sbomify.com/CVE-2023-5789/): Dragon Path 707GR1 Ping Diagnostics cross site scripting (low 2.4)
- [CVE-2023-5787](https://insights.sbomify.com/CVE-2023-5787/): Shaanxi Chanming Education Technology Score Query System sql injection (high 7.3)
- [CVE-2023-5786](https://insights.sbomify.com/CVE-2023-5786/): GeoServer GeoWebCache rest.html direct request (medium 5.3)
- [CVE-2023-5785](https://insights.sbomify.com/CVE-2023-5785/): Netentsec NS-ASG Application Security Gateway addaddress_interpret.php sql injection (medium 5.5)
- [CVE-2023-5784](https://insights.sbomify.com/CVE-2023-5784/): Netentsec NS-ASG Application Security Gateway uploadfirewall.php sql injection (medium 5.5)
- [CVE-2023-5783](https://insights.sbomify.com/CVE-2023-5783/): Tongda OA 2017 delete.php sql injection (medium 6.3)
- [CVE-2023-5782](https://insights.sbomify.com/CVE-2023-5782/): Tongda OA 2017 General News delete_query.php sql injection (medium 5.5)
- [CVE-2023-5781](https://insights.sbomify.com/CVE-2023-5781/): Tongda OA 2017 delete_webmail.php DELETE_STR sql injection (medium 6.3)
- [CVE-2023-5780](https://insights.sbomify.com/CVE-2023-5780/): Tongda OA 2017 delete.php sql injection (high 7.3)
- [CVE-2023-5779](https://insights.sbomify.com/CVE-2023-5779/): can: out of bounds in remove_rx_filter function (medium 4.4)
- [CVE-2023-5778](https://insights.sbomify.com/CVE-2023-5778/): Missing Length Check (critical 9.2)
- [CVE-2023-5777](https://insights.sbomify.com/CVE-2023-5777/): Weintek EasyBuilder Pro Use of Hard-coded Credentials (critical 9.8)
- [CVE-2023-5776](https://insights.sbomify.com/CVE-2023-5776/): Post Meta Data Manager <= 1.2.1 - Cross-Site Request Forgery to Post, Term, and User Meta Deletion (medium 4.3)
- [CVE-2023-5775](https://insights.sbomify.com/CVE-2023-5775/): BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password (low 2.2)
- [CVE-2023-5774](https://insights.sbomify.com/CVE-2023-5774/): Animated Counters <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5772](https://insights.sbomify.com/CVE-2023-5772/): Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-5771](https://insights.sbomify.com/CVE-2023-5771/): HTML injection in AdminUI through email subject (medium 6.1)
- [CVE-2023-5770](https://insights.sbomify.com/CVE-2023-5770/): HTML injection in email body through email subject (medium 5.3)
- [CVE-2023-5769](https://insights.sbomify.com/CVE-2023-5769/): Cross-site scripting in RTU500 (medium 5.4)
- [CVE-2023-5768](https://insights.sbomify.com/CVE-2023-5768/): Denial of service in RTU500 series (medium 5.9)
- [CVE-2023-5767](https://insights.sbomify.com/CVE-2023-5767/): Cross-site scripting in RTU500 (medium 6.0)
- [CVE-2023-5766](https://insights.sbomify.com/CVE-2023-5766/): Other in Remote Desktop Manager (high 8.8)
- [CVE-2023-5765](https://insights.sbomify.com/CVE-2023-5765/): Missing authorization in Remote Desktop Manager (critical 9.8)
- [CVE-2023-5764](https://insights.sbomify.com/CVE-2023-5764/): Ansible: template injection (high 7.1)
- [CVE-2023-5763](https://insights.sbomify.com/CVE-2023-5763/): Glassfish remote code execution (medium 6.8)
- [CVE-2023-5762](https://insights.sbomify.com/CVE-2023-5762/): Filr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext (high 8.8)
- [CVE-2023-5761](https://insights.sbomify.com/CVE-2023-5761/): SQL injection in Burst Statistics Pro (critical 9.8)
- [CVE-2023-5760](https://insights.sbomify.com/CVE-2023-5760/): Time-of-check to time-of-use (TOCTOU) bug leads to full local privilege escalation. (high 8.2)
- [CVE-2023-5759](https://insights.sbomify.com/CVE-2023-5759/): Unauthenticated Remote Denial-of-Service via Buffer in Helix Core (high 7.5)
- [CVE-2023-5758](https://insights.sbomify.com/CVE-2023-5758/): Cross-site scripting in Firefox for iOS (medium 6.1)
- [CVE-2023-5757](https://insights.sbomify.com/CVE-2023-5757/): WP Crowdfunding < 2.1.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-5756](https://insights.sbomify.com/CVE-2023-5756/): Digital Publications by Supsystic <= 1.7.6 - Cross-Site Request Forgery via AJAX action (medium 5.4)
- [CVE-2023-5754](https://insights.sbomify.com/CVE-2023-5754/): Improper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000 (critical 9.1)
- [CVE-2023-5753](https://insights.sbomify.com/CVE-2023-5753/): Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem (medium 6.3)
- [CVE-2023-5752](https://insights.sbomify.com/CVE-2023-5752/): Mercurial configuration injectable in repo revision when installing via pip (medium 5.5)
- [CVE-2023-5751](https://insights.sbomify.com/CVE-2023-5751/): CODESYS: Development system prone to DoS through exposure of resource to wrong sphere (high 7.8)
- [CVE-2023-5750](https://insights.sbomify.com/CVE-2023-5750/): EmbedPress < 3.9.2 - Reflected XSS (medium 6.1)
- [CVE-2023-5749](https://insights.sbomify.com/CVE-2023-5749/): EmbedPress < 3.9.2 - Reflected XSS (medium 6.1)
- [CVE-2023-5748](https://insights.sbomify.com/CVE-2023-5748/): Memory corruption in Synology SSL VPN Client (low 3.3)
- [CVE-2023-5747](https://insights.sbomify.com/CVE-2023-5747/): Command injection via wave install file (high 7.2)
- [CVE-2023-5746](https://insights.sbomify.com/CVE-2023-5746/): Memory corruption in Camera Firmware (critical 9.8)
- [CVE-2023-5745](https://insights.sbomify.com/CVE-2023-5745/): Reusable Text Blocks <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode (medium 5.5)
- [CVE-2023-5744](https://insights.sbomify.com/CVE-2023-5744/): Very Simple Google Maps <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5743](https://insights.sbomify.com/CVE-2023-5743/): Telephone Number Linker <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5742](https://insights.sbomify.com/CVE-2023-5742/): EasyRotator for WordPress <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5741](https://insights.sbomify.com/CVE-2023-5741/): POWR <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5740](https://insights.sbomify.com/CVE-2023-5740/): Live Chat with Facebook Messenger <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5739](https://insights.sbomify.com/CVE-2023-5739/): Privilege escalation in HP PC Hardware Diagnostics Windows (high 7.8)
- [CVE-2023-5738](https://insights.sbomify.com/CVE-2023-5738/): WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-5737](https://insights.sbomify.com/CVE-2023-5737/): WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update (medium 4.3)
- [CVE-2023-5732](https://insights.sbomify.com/CVE-2023-5732/): Address bar spoofing via bidirectional characters (medium 6.5)
- [CVE-2023-5731](https://insights.sbomify.com/CVE-2023-5731/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-5730](https://insights.sbomify.com/CVE-2023-5730/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-5729](https://insights.sbomify.com/CVE-2023-5729/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-5728](https://insights.sbomify.com/CVE-2023-5728/): Use after free in Firefox (high 7.5)
- [CVE-2023-5727](https://insights.sbomify.com/CVE-2023-5727/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-5726](https://insights.sbomify.com/CVE-2023-5726/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-5725](https://insights.sbomify.com/CVE-2023-5725/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-5724](https://insights.sbomify.com/CVE-2023-5724/): Denial of service in Firefox (high 7.5)
- [CVE-2023-5723](https://insights.sbomify.com/CVE-2023-5723/): Other in Firefox (medium 5.3)
- [CVE-2023-5722](https://insights.sbomify.com/CVE-2023-5722/): Information disclosure in Firefox (medium 5.3)
- [CVE-2023-5721](https://insights.sbomify.com/CVE-2023-5721/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-5720](https://insights.sbomify.com/CVE-2023-5720/): Quarkus: build env information disclosure via gradle plugin (high 7.7)
- [CVE-2023-5719](https://insights.sbomify.com/CVE-2023-5719/): Red Lion Crimson Improper Neutralization of Null Byte or NUL Character (high 8.8)
- [CVE-2023-5718](https://insights.sbomify.com/CVE-2023-5718/): Information disclosure in Vue.js devtools (medium 4.3)
- [CVE-2023-5717](https://insights.sbomify.com/CVE-2023-5717/): Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/137/