# Vulnerabilities published in 2023


- [CVE-2023-5496](https://insights.sbomify.com/CVE-2023-5496/): Translator PoqDev Add-On Select Text cross site scripting (low 3.1)
- [CVE-2023-5495](https://insights.sbomify.com/CVE-2023-5495/): QDocs Smart School HTTP POST Request sql injection (medium 6.3)
- [CVE-2023-5494](https://insights.sbomify.com/CVE-2023-5494/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform download.php os command injection (medium 6.3)
- [CVE-2023-5493](https://insights.sbomify.com/CVE-2023-5493/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform web.php unrestricted upload (medium 6.3)
- [CVE-2023-5492](https://insights.sbomify.com/CVE-2023-5492/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform licence.php unrestricted upload (medium 6.3)
- [CVE-2023-5491](https://insights.sbomify.com/CVE-2023-5491/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform updatelib.php unrestricted upload (medium 6.3)
- [CVE-2023-5490](https://insights.sbomify.com/CVE-2023-5490/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform userattestation.php unrestricted upload (medium 6.3)
- [CVE-2023-5489](https://insights.sbomify.com/CVE-2023-5489/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform uploadfile.php unrestricted upload (medium 6.3)
- [CVE-2023-5488](https://insights.sbomify.com/CVE-2023-5488/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform updatelib.php unrestricted upload (medium 6.3)
- [CVE-2023-5487](https://insights.sbomify.com/CVE-2023-5487/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-5486](https://insights.sbomify.com/CVE-2023-5486/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5485](https://insights.sbomify.com/CVE-2023-5485/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5484](https://insights.sbomify.com/CVE-2023-5484/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-5483](https://insights.sbomify.com/CVE-2023-5483/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-5482](https://insights.sbomify.com/CVE-2023-5482/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-5481](https://insights.sbomify.com/CVE-2023-5481/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-5480](https://insights.sbomify.com/CVE-2023-5480/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2023-5479](https://insights.sbomify.com/CVE-2023-5479/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-5478](https://insights.sbomify.com/CVE-2023-5478/): Information disclosure in Chrome (medium 4.3)
- [CVE-2023-5477](https://insights.sbomify.com/CVE-2023-5477/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-5476](https://insights.sbomify.com/CVE-2023-5476/): Use after free in Chrome (high 8.8)
- [CVE-2023-5475](https://insights.sbomify.com/CVE-2023-5475/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-5474](https://insights.sbomify.com/CVE-2023-5474/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-5473](https://insights.sbomify.com/CVE-2023-5473/): Use after free in Chrome (medium 6.3)
- [CVE-2023-5472](https://insights.sbomify.com/CVE-2023-5472/): Use after free in Chrome (high 8.8)
- [CVE-2023-5471](https://insights.sbomify.com/CVE-2023-5471/): codeprojects Farmacia index.php sql injection (medium 6.3)
- [CVE-2023-5470](https://insights.sbomify.com/CVE-2023-5470/): Etsy Shop <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5469](https://insights.sbomify.com/CVE-2023-5469/): Drop Shadow Boxes <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5468](https://insights.sbomify.com/CVE-2023-5468/): Slick Contact Forms <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5467](https://insights.sbomify.com/CVE-2023-5467/): GEO my WordPress <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5466](https://insights.sbomify.com/CVE-2023-5466/): Wp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-5465](https://insights.sbomify.com/CVE-2023-5465/): Popup with fancybox <= 3.5 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-5464](https://insights.sbomify.com/CVE-2023-5464/): Jquery accordion slideshow <= 8.1 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-5463](https://insights.sbomify.com/CVE-2023-5463/): XINJE XDPPro cfgmgr32.dll uncontrolled search path (high 7.8)
- [CVE-2023-5462](https://insights.sbomify.com/CVE-2023-5462/): XINJE XD5E-30R-E Modbus denial of service (medium 6.5)
- [CVE-2023-5461](https://insights.sbomify.com/CVE-2023-5461/): Delta Electronics WPLSoft Modbus cleartext transmission (low 3.7)
- [CVE-2023-5460](https://insights.sbomify.com/CVE-2023-5460/): Delta Electronics WPLSoft Modbus Data Packet heap-based overflow (low 3.5)
- [CVE-2023-5459](https://insights.sbomify.com/CVE-2023-5459/): Delta Electronics DVP32ES2 PLC Password Transmission denial of service (medium 6.5)
- [CVE-2023-5458](https://insights.sbomify.com/CVE-2023-5458/): CITS Support svg, webp Media and TTF,OTF File Upload < 3.0 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2023-5457](https://insights.sbomify.com/CVE-2023-5457/): Misconfiguration in imx6 bundle (high 7.5)
- [CVE-2023-5456](https://insights.sbomify.com/CVE-2023-5456/): Hardcoded credentials in imx6 bundle (high 8.1)
- [CVE-2023-5455](https://insights.sbomify.com/CVE-2023-5455/): Ipa: invalid csrf protection (medium 6.5)
- [CVE-2023-5454](https://insights.sbomify.com/CVE-2023-5454/): Templately < 2.2.6 - Arbitrary post trashing via Missing Authorization (high 7.5)
- [CVE-2023-5452](https://insights.sbomify.com/CVE-2023-5452/): Cross-site Scripting (XSS) - Stored in snipe/snipe-it (medium 5.5)
- [CVE-2023-5451](https://insights.sbomify.com/CVE-2023-5451/): Cross-site scripting in Next Generation Firewall Security Management Center (medium 6.1)
- [CVE-2023-5450](https://insights.sbomify.com/CVE-2023-5450/): BIG-IP Edge Client for macOS vulnerability (high 7.3)
- [CVE-2023-5449](https://insights.sbomify.com/CVE-2023-5449/): Security feature bypass in HP Displays (low 3.3)
- [CVE-2023-5448](https://insights.sbomify.com/CVE-2023-5448/): WP Register Profile With Shortcode <= 3.5.9 - Cross-Site Request Forgery to User Password Reset (high 8.8)
- [CVE-2023-5447](https://insights.sbomify.com/CVE-2023-5447/): Use-After-Free in Service for Hardware Support App for Fingerprint Driver (medium 5.5)
- [CVE-2023-5445](https://insights.sbomify.com/CVE-2023-5445/): Open redirect in ePolicy Orchestrator (medium 5.4)
- [CVE-2023-5444](https://insights.sbomify.com/CVE-2023-5444/): CSRF in ePO leading to privilege escalation (high 8.0)
- [CVE-2023-5443](https://insights.sbomify.com/CVE-2023-5443/): User Enumeration in EDM Informatic's E-Invoice Software (high 7.5)
- [CVE-2023-54413](https://insights.sbomify.com/CVE-2023-54413/): WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang (medium 5.1)
- [CVE-2023-54412](https://insights.sbomify.com/CVE-2023-54412/): Frappe before 13.46.3 Improper Access Control for Email Templates (high 7.1)
- [CVE-2023-54411](https://insights.sbomify.com/CVE-2023-54411/): Frappe before 13.32.0 Weak Authentication via Print View Key (high 8.2)
- [CVE-2023-54410](https://insights.sbomify.com/CVE-2023-54410/): Frappe before 13.22.0 Improper Authorization via Document Rename (medium 5.3)
- [CVE-2023-5441](https://insights.sbomify.com/CVE-2023-5441/): NULL Pointer Dereference in vim/vim (medium 6.2)
- [CVE-2023-54409](https://insights.sbomify.com/CVE-2023-54409/): Frappe before 13.46.1 XSS via html2text Weak Sanitization (medium 5.9)
- [CVE-2023-54408](https://insights.sbomify.com/CVE-2023-54408/): Frappe before 14.31.0 HTML Injection via Weak Escaping (medium 5.1)
- [CVE-2023-54407](https://insights.sbomify.com/CVE-2023-54407/): Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks (medium 6.9)
- [CVE-2023-54406](https://insights.sbomify.com/CVE-2023-54406/): Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts (medium 6.9)
- [CVE-2023-54405](https://insights.sbomify.com/CVE-2023-54405/): H3C CVM Unauthenticated File Upload via fileUpload/upload Token (critical 9.3)
- [CVE-2023-54403](https://insights.sbomify.com/CVE-2023-54403/): Yonyou U8 CRM Arbitrary File Read via getemaildata.php (high 8.7)
- [CVE-2023-54402](https://insights.sbomify.com/CVE-2023-54402/): iDocView SSRF via /doc/upload Endpoint Hardcoded Token (high 8.7)
- [CVE-2023-54400](https://insights.sbomify.com/CVE-2023-54400/): Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname (critical 9.3)
- [CVE-2023-54399](https://insights.sbomify.com/CVE-2023-54399/): Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree (critical 9.3)
- [CVE-2023-54398](https://insights.sbomify.com/CVE-2023-54398/): Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet (critical 9.3)
- [CVE-2023-54397](https://insights.sbomify.com/CVE-2023-54397/): Tornado before 6.3.3 HTTP Request Smuggling via Content-Length (critical 9.0)
- [CVE-2023-54396](https://insights.sbomify.com/CVE-2023-54396/): PocketMine-MP before 4.8.1 Server Crash via Banner NBT (high 7.1)
- [CVE-2023-54395](https://insights.sbomify.com/CVE-2023-54395/): PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket (medium 5.3)
- [CVE-2023-54394](https://insights.sbomify.com/CVE-2023-54394/): PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket (medium 5.3)
- [CVE-2023-54393](https://insights.sbomify.com/CVE-2023-54393/): PocketMine-MP before 4.20.5 Denial of Service via LoginPacket (high 8.7)
- [CVE-2023-54392](https://insights.sbomify.com/CVE-2023-54392/): PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket (high 7.1)
- [CVE-2023-54391](https://insights.sbomify.com/CVE-2023-54391/): Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter (critical 9.3)
- [CVE-2023-54390](https://insights.sbomify.com/CVE-2023-54390/): PocketMine-MP before 5.3.1 Denial of Service via LoginPacket (high 8.7)
- [CVE-2023-5439](https://insights.sbomify.com/CVE-2023-5439/): Wp photo text slider 50 <= 8.0 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-5438](https://insights.sbomify.com/CVE-2023-5438/): wp image slideshow <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-5437](https://insights.sbomify.com/CVE-2023-5437/): WP fade in text news <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-54366](https://insights.sbomify.com/CVE-2023-54366/): SurrealDB before 1.0.1 Insecure Default Table Permissions (high 8.7)
- [CVE-2023-54365](https://insights.sbomify.com/CVE-2023-54365/): Traefik - Denial of Service via HTTP/2 Request Handling (high 8.7)
- [CVE-2023-54364](https://insights.sbomify.com/CVE-2023-54364/): Joomla HikaShop 4.7.4 Reflected XSS via Product Filter (medium 5.1)
- [CVE-2023-54363](https://insights.sbomify.com/CVE-2023-54363/): Joomla Solidres 2.13.3 Reflected XSS via Multiple Parameters (medium 5.1)
- [CVE-2023-54362](https://insights.sbomify.com/CVE-2023-54362/): Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword (medium 5.1)
- [CVE-2023-54361](https://insights.sbomify.com/CVE-2023-54361/): Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword (medium 5.1)
- [CVE-2023-54360](https://insights.sbomify.com/CVE-2023-54360/): Joomla JLex Review 6.0.1 Reflected XSS via review_id Parameter (medium 5.1)
- [CVE-2023-5436](https://insights.sbomify.com/CVE-2023-5436/): Vertical marquee plugin <= 7.1 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-54359](https://insights.sbomify.com/CVE-2023-54359/): WordPress adivaha Travel Plugin 2.3 SQL Injection via pid (high 8.8)
- [CVE-2023-54358](https://insights.sbomify.com/CVE-2023-54358/): WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile (medium 5.1)
- [CVE-2023-54357](https://insights.sbomify.com/CVE-2023-54357/): Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration (high 8.7)
- [CVE-2023-54356](https://insights.sbomify.com/CVE-2023-54356/): Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites (critical 9.3)
- [CVE-2023-54355](https://insights.sbomify.com/CVE-2023-54355/): PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve (high 8.7)
- [CVE-2023-54353](https://insights.sbomify.com/CVE-2023-54353/): Chromacam 4.0.3.0 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2023-54352](https://insights.sbomify.com/CVE-2023-54352/): WordPress Seotheme Remote Code Execution Unauthenticated (critical 9.3)
- [CVE-2023-54351](https://insights.sbomify.com/CVE-2023-54351/): WordPress Sonaar Music Plugin 4.7 Stored XSS via Comments (medium 5.1)
- [CVE-2023-54350](https://insights.sbomify.com/CVE-2023-54350/): WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated (high 8.7)
- [CVE-2023-5435](https://insights.sbomify.com/CVE-2023-5435/): Up down image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-54349](https://insights.sbomify.com/CVE-2023-54349/): AmazCart CMS 3.4 Reflected Cross-Site Scripting via Search (medium 5.1)
- [CVE-2023-54348](https://insights.sbomify.com/CVE-2023-54348/): ERPGo SaaS 3.9 CSV Injection via Vendor Creation (high 8.7)
- [CVE-2023-54347](https://insights.sbomify.com/CVE-2023-54347/): OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass (high 8.7)
- [CVE-2023-54346](https://insights.sbomify.com/CVE-2023-54346/): WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/140/