# Vulnerabilities published in 2023


- [CVE-2023-5716](https://insights.sbomify.com/CVE-2023-5716/): ASUS Armoury Crate - Arbitrary File Write (critical 9.8)
- [CVE-2023-5715](https://insights.sbomify.com/CVE-2023-5715/): Website Optimization – Plerdy <= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-5714](https://insights.sbomify.com/CVE-2023-5714/): System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs) (medium 4.3)
- [CVE-2023-5713](https://insights.sbomify.com/CVE-2023-5713/): System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value) (medium 4.3)
- [CVE-2023-5712](https://insights.sbomify.com/CVE-2023-5712/): System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value) (medium 4.3)
- [CVE-2023-5711](https://insights.sbomify.com/CVE-2023-5711/): System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info) (medium 4.3)
- [CVE-2023-5710](https://insights.sbomify.com/CVE-2023-5710/): System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants) (medium 4.3)
- [CVE-2023-5709](https://insights.sbomify.com/CVE-2023-5709/): WD WidgetTwitter <= 1.0.9 - Authenticated (Contributor+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-5708](https://insights.sbomify.com/CVE-2023-5708/): WP Post Columns <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5707](https://insights.sbomify.com/CVE-2023-5707/): SEO Slider <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5706](https://insights.sbomify.com/CVE-2023-5706/): VK Blocks <= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block (medium 6.4)
- [CVE-2023-5705](https://insights.sbomify.com/CVE-2023-5705/): VK Filter Search <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5704](https://insights.sbomify.com/CVE-2023-5704/): CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5703](https://insights.sbomify.com/CVE-2023-5703/): Cross-site scripting in Gift Up Gift Cards for WordPress and WooCommerce (medium 6.4)
- [CVE-2023-5702](https://insights.sbomify.com/CVE-2023-5702/): Viessmann Vitogate 300 direct request (medium 4.3)
- [CVE-2023-5701](https://insights.sbomify.com/CVE-2023-5701/): vnotex vnote Markdown File cross site scripting (medium 4.3)
- [CVE-2023-5700](https://insights.sbomify.com/CVE-2023-5700/): Netentsec NS-ASG Application Security Gateway uploadiscgwrouteconf.php sql injection (medium 5.5)
- [CVE-2023-5699](https://insights.sbomify.com/CVE-2023-5699/): CodeAstro Internet Banking System pages_view_client.php cross site scripting (low 3.5)
- [CVE-2023-5698](https://insights.sbomify.com/CVE-2023-5698/): CodeAstro Internet Banking System pages_deposit_money.php cross site scripting (low 3.5)
- [CVE-2023-5697](https://insights.sbomify.com/CVE-2023-5697/): CodeAstro Internet Banking System pages_withdraw_money.php cross site scripting (low 3.5)
- [CVE-2023-5696](https://insights.sbomify.com/CVE-2023-5696/): CodeAstro Internet Banking System pages_transfer_money.php cross site scripting (low 3.5)
- [CVE-2023-5695](https://insights.sbomify.com/CVE-2023-5695/): CodeAstro Internet Banking System pages_reset_pwd.php cross site scripting (low 3.5)
- [CVE-2023-5694](https://insights.sbomify.com/CVE-2023-5694/): CodeAstro Internet Banking System pages_system_settings.php cross site scripting (low 3.5)
- [CVE-2023-5693](https://insights.sbomify.com/CVE-2023-5693/): CodeAstro Internet Banking System pages_reset_pwd.php sql injection (medium 6.3)
- [CVE-2023-5692](https://insights.sbomify.com/CVE-2023-5692/): WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink (medium 5.3)
- [CVE-2023-5691](https://insights.sbomify.com/CVE-2023-5691/): Cross-site scripting in Collect.chat Chatbot ⚡️ (medium 4.4)
- [CVE-2023-5690](https://insights.sbomify.com/CVE-2023-5690/): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (medium 5.3)
- [CVE-2023-5689](https://insights.sbomify.com/CVE-2023-5689/): Cross-site Scripting (XSS) - DOM in modoboa/modoboa (high 7.1)
- [CVE-2023-5688](https://insights.sbomify.com/CVE-2023-5688/): Cross-site Scripting (XSS) - DOM in modoboa/modoboa (critical 9.8)
- [CVE-2023-5687](https://insights.sbomify.com/CVE-2023-5687/): Cross-Site Request Forgery (CSRF) in mosparo/mosparo (medium 5.4)
- [CVE-2023-5686](https://insights.sbomify.com/CVE-2023-5686/): Heap-based Buffer Overflow in radareorg/radare2 (medium 5.1)
- [CVE-2023-5685](https://insights.sbomify.com/CVE-2023-5685/): Xnio: stackoverflowexception when the chain of notifier states becomes problematically big (high 7.5)
- [CVE-2023-5684](https://insights.sbomify.com/CVE-2023-5684/): Byzoro Smart S85F Management Platform importexport.php os command injection (medium 4.7)
- [CVE-2023-5683](https://insights.sbomify.com/CVE-2023-5683/): Byzoro Smart S85F Management Platform importconf.php os command injection (medium 6.3)
- [CVE-2023-5682](https://insights.sbomify.com/CVE-2023-5682/): Tongda OA delete.php sql injection (medium 5.5)
- [CVE-2023-5681](https://insights.sbomify.com/CVE-2023-5681/): Netentsec NS-ASG Application Security Gateway list_addr_fwresource_ip.php sql injection (medium 4.7)
- [CVE-2023-5680](https://insights.sbomify.com/CVE-2023-5680/): Cleaning an ECS-enabled cache may cause excessive CPU load (medium 5.3)
- [CVE-2023-5679](https://insights.sbomify.com/CVE-2023-5679/): Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (high 7.5)
- [CVE-2023-5678](https://insights.sbomify.com/CVE-2023-5678/): Excessive time spent in DH check / generation with large Q parameter value (medium 5.3)
- [CVE-2023-5677](https://insights.sbomify.com/CVE-2023-5677/): Command injection in AXIS OS (medium 6.3)
- [CVE-2023-5676](https://insights.sbomify.com/CVE-2023-5676/): Eclipse OpenJ9 possible infinite busy hang (medium 4.1)
- [CVE-2023-5675](https://insights.sbomify.com/CVE-2023-5675/): Quarkus: authorization flaw in quarkus resteasy reactive and classic (medium 6.5)
- [CVE-2023-5674](https://insights.sbomify.com/CVE-2023-5674/): WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint (high 8.8)
- [CVE-2023-5673](https://insights.sbomify.com/CVE-2023-5673/): WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCE (high 8.8)
- [CVE-2023-5672](https://insights.sbomify.com/CVE-2023-5672/): WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint (medium 6.5)
- [CVE-2023-5671](https://insights.sbomify.com/CVE-2023-5671/): Privilege escalation in HP Print and Scan Doctor for Windows (high 7.8)
- [CVE-2023-5669](https://insights.sbomify.com/CVE-2023-5669/): Featured Image Caption <= 0.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5668](https://insights.sbomify.com/CVE-2023-5668/): WhatsApp Share Button <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5667](https://insights.sbomify.com/CVE-2023-5667/): Tab Ultimate <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5666](https://insights.sbomify.com/CVE-2023-5666/): Accordion <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5665](https://insights.sbomify.com/CVE-2023-5665/): Payment Forms for Paystack <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5664](https://insights.sbomify.com/CVE-2023-5664/): Garden Gnome Package <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5663](https://insights.sbomify.com/CVE-2023-5663/): News Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-5662](https://insights.sbomify.com/CVE-2023-5662/): Sponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5661](https://insights.sbomify.com/CVE-2023-5661/): Social Feed <= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5660](https://insights.sbomify.com/CVE-2023-5660/): SendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5659](https://insights.sbomify.com/CVE-2023-5659/): Interact: Embed A Quiz On Your Site <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5658](https://insights.sbomify.com/CVE-2023-5658/): WP MapIt <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5654](https://insights.sbomify.com/CVE-2023-5654/): React Developer Tools extension Improper Authorization vulnerability (medium 6.5)
- [CVE-2023-5653](https://insights.sbomify.com/CVE-2023-5653/): WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-5652](https://insights.sbomify.com/CVE-2023-5652/): WP Hotel Booking < 2.0.8 - Unauthenticated SQLi (critical 9.8)
- [CVE-2023-5651](https://insights.sbomify.com/CVE-2023-5651/): WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion (medium 5.4)
- [CVE-2023-5650](https://insights.sbomify.com/CVE-2023-5650/): Privilege escalation in USG20(W)-VPN series firmware (medium 5.5)
- [CVE-2023-5649](https://insights.sbomify.com/CVE-2023-5649/): Denial of service in Brocade Active Support Connectivity Gateway (medium 6.8)
- [CVE-2023-5648](https://insights.sbomify.com/CVE-2023-5648/): Misconfiguration in Active Support Connectivity Gateway (medium 6.5)
- [CVE-2023-5645](https://insights.sbomify.com/CVE-2023-5645/): WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint (high 8.8)
- [CVE-2023-5644](https://insights.sbomify.com/CVE-2023-5644/): WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints (high 7.6)
- [CVE-2023-5643](https://insights.sbomify.com/CVE-2023-5643/): Mali GPU Kernel Driver allows improper GPU memory processing operations (high 7.8)
- [CVE-2023-5642](https://insights.sbomify.com/CVE-2023-5642/): Advantech R-SeeNet Unauthenticated Read/Write (critical 9.8)
- [CVE-2023-5641](https://insights.sbomify.com/CVE-2023-5641/): Martins Free & Easy SEO Link buildings < 1.2.30 - Reflected XSS (medium 6.1)
- [CVE-2023-5640](https://insights.sbomify.com/CVE-2023-5640/): Article Analytics <= 1.0 - Unauthenticated SQL injection (critical 9.8)
- [CVE-2023-5639](https://insights.sbomify.com/CVE-2023-5639/): Team Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5638](https://insights.sbomify.com/CVE-2023-5638/): Booster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5637](https://insights.sbomify.com/CVE-2023-5637/): Plaintext Storage of a Password in ArslanSoft's Education Portal (high 7.5)
- [CVE-2023-5636](https://insights.sbomify.com/CVE-2023-5636/): Malicious File Upload in ArslanSoft's Education Portal (critical 9.8)
- [CVE-2023-5635](https://insights.sbomify.com/CVE-2023-5635/): User Enumeration in ArslanSoft's Education Portal (high 7.5)
- [CVE-2023-5634](https://insights.sbomify.com/CVE-2023-5634/): SQLi in ArslanSoft's Education Portal (critical 9.8)
- [CVE-2023-5633](https://insights.sbomify.com/CVE-2023-5633/): Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling (high 7.8)
- [CVE-2023-5632](https://insights.sbomify.com/CVE-2023-5632/): Unconditionally adding an event to the epoll causes excessive CPU consumption (high 7.5)
- [CVE-2023-5631](https://insights.sbomify.com/CVE-2023-5631/): Roundcube Webmail Persistent Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2023-5630](https://insights.sbomify.com/CVE-2023-5630/): Security feature bypass in Trio E-Series Ethernet Data Radio (medium 6.5)
- [CVE-2023-5629](https://insights.sbomify.com/CVE-2023-5629/): Open redirect in Trio E-Series Ethernet Data Radio (high 8.2)
- [CVE-2023-5627](https://insights.sbomify.com/CVE-2023-5627/): Incorrect Implementation of Authentication Algorithm Vulnerability (high 7.5)
- [CVE-2023-5626](https://insights.sbomify.com/CVE-2023-5626/): Cross-Site Request Forgery (CSRF) in pkp/ojs (low 3.5)
- [CVE-2023-5625](https://insights.sbomify.com/CVE-2023-5625/): Python-eventlet: patch regression for cve-2021-21419 in some red hat builds (medium 5.3)
- [CVE-2023-5624](https://insights.sbomify.com/CVE-2023-5624/): Blind SQL Injection (high 7.2)
- [CVE-2023-5623](https://insights.sbomify.com/CVE-2023-5623/): Privilege Escalation (high 7.0)
- [CVE-2023-5622](https://insights.sbomify.com/CVE-2023-5622/): Privilege Escalation (high 7.1)
- [CVE-2023-5621](https://insights.sbomify.com/CVE-2023-5621/): Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title (medium 4.4)
- [CVE-2023-5620](https://insights.sbomify.com/CVE-2023-5620/): Webpushr < 4.35.0 - Unauthenticated Stored XSS (medium 5.4)
- [CVE-2023-5618](https://insights.sbomify.com/CVE-2023-5618/): Modern Footnotes <= 1.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5617](https://insights.sbomify.com/CVE-2023-5617/): Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive Information (medium 5.3)
- [CVE-2023-5616](https://insights.sbomify.com/CVE-2023-5616/): Security feature bypass in Ubuntu's gnome-control-center (medium 4.9)
- [CVE-2023-5615](https://insights.sbomify.com/CVE-2023-5615/): Skype Legacy Buttons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5614](https://insights.sbomify.com/CVE-2023-5614/): Theme Switcha <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5613](https://insights.sbomify.com/CVE-2023-5613/): Super Testimonials <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5612](https://insights.sbomify.com/CVE-2023-5612/): Missing Authorization in GitLab (medium 5.3)
- [CVE-2023-5611](https://insights.sbomify.com/CVE-2023-5611/): Seraphinite Accelerator < 2.20.32 - Unauthorised Settings Reset/Import (medium 5.3)
- [CVE-2023-5610](https://insights.sbomify.com/CVE-2023-5610/): Seraphinite Accelerator < 2.20.29 - Authenticated Arbitrary Redirect (medium 5.4)
- [CVE-2023-5609](https://insights.sbomify.com/CVE-2023-5609/): Seraphinite Accelerator < 2.20.29 - Reflected XSS (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/138/