# Vulnerabilities published in 2023


- [CVE-2023-53971](https://insights.sbomify.com/CVE-2023-53971/): WebTareas 2.4 Authenticated Remote Code Execution via File Upload (high 8.7)
- [CVE-2023-53970](https://insights.sbomify.com/CVE-2023-53970/): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config (high 8.7)
- [CVE-2023-5397](https://insights.sbomify.com/CVE-2023-5397/): Other in Experion Server (high 8.1)
- [CVE-2023-53969](https://insights.sbomify.com/CVE-2023-53969/): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change (critical 9.3)
- [CVE-2023-53968](https://insights.sbomify.com/CVE-2023-53968/): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase Account (critical 9.3)
- [CVE-2023-53967](https://insights.sbomify.com/CVE-2023-53967/): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password Change (critical 9.3)
- [CVE-2023-53966](https://insights.sbomify.com/CVE-2023-53966/): SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow (critical 9.3)
- [CVE-2023-53965](https://insights.sbomify.com/CVE-2023-53965/): SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path (high 8.6)
- [CVE-2023-53964](https://insights.sbomify.com/CVE-2023-53964/): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset Vulnerability (high 8.8)
- [CVE-2023-53963](https://insights.sbomify.com/CVE-2023-53963/): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection (critical 9.3)
- [CVE-2023-53962](https://insights.sbomify.com/CVE-2023-53962/): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write (high 8.8)
- [CVE-2023-53961](https://insights.sbomify.com/CVE-2023-53961/): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery (medium 5.1)
- [CVE-2023-53960](https://insights.sbomify.com/CVE-2023-53960/): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication Bypass (critical 9.3)
- [CVE-2023-5396](https://insights.sbomify.com/CVE-2023-5396/): Memory corruption in Experion Server (high 7.4)
- [CVE-2023-53959](https://insights.sbomify.com/CVE-2023-53959/): FileZilla Client 3.63.1 DLL Hijacking via Missing TextShaping.dll (high 8.5)
- [CVE-2023-53958](https://insights.sbomify.com/CVE-2023-53958/): LDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Header (high 8.6)
- [CVE-2023-53957](https://insights.sbomify.com/CVE-2023-53957/): Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking (high 8.5)
- [CVE-2023-53956](https://insights.sbomify.com/CVE-2023-53956/): Flatnux 2021-03.25 Authenticated File Upload Remote Code Execution (high 8.7)
- [CVE-2023-53955](https://insights.sbomify.com/CVE-2023-53955/): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References (critical 9.3)
- [CVE-2023-53954](https://insights.sbomify.com/CVE-2023-53954/): ActFax 10.10 Unquoted Path Services Privilege Escalation Vulnerability (high 8.5)
- [CVE-2023-53953](https://insights.sbomify.com/CVE-2023-53953/): WebsiteBaker 2.13.3 Stored Cross-Site Scripting via Page Creation (medium 5.1)
- [CVE-2023-53952](https://insights.sbomify.com/CVE-2023-53952/): Dotclear 2.25.3 Authenticated Remote Code Execution via File Upload (high 8.7)
- [CVE-2023-53951](https://insights.sbomify.com/CVE-2023-53951/): Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret (critical 9.3)
- [CVE-2023-53950](https://insights.sbomify.com/CVE-2023-53950/): InnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulation (critical 9.3)
- [CVE-2023-5395](https://insights.sbomify.com/CVE-2023-5395/): Memory corruption in Experion Server (high 8.1)
- [CVE-2023-53949](https://insights.sbomify.com/CVE-2023-53949/): AspEmail 5.6.0.2 Local Privilege Escalation via Binary Permission Vulnerability (high 8.5)
- [CVE-2023-53948](https://insights.sbomify.com/CVE-2023-53948/): Lilac-Reloaded for Nagios 2.0.8 Remote Code Execution via Autodiscovery (critical 9.3)
- [CVE-2023-53947](https://insights.sbomify.com/CVE-2023-53947/): OCS Inventory NG 2.3.0.0 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2023-53946](https://insights.sbomify.com/CVE-2023-53946/): Arcsoft PhotoStudio 6.0.0.172 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2023-53945](https://insights.sbomify.com/CVE-2023-53945/): BrainyCP 1.0 Remote Code Execution via Authenticated Crontab Manipulation (high 8.7)
- [CVE-2023-53944](https://insights.sbomify.com/CVE-2023-53944/): EasyPHP Webserver 14.1 Path Traversal via Directory Traversal Sequences (high 7.1)
- [CVE-2023-53943](https://insights.sbomify.com/CVE-2023-53943/): GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint (medium 6.9)
- [CVE-2023-53942](https://insights.sbomify.com/CVE-2023-53942/): File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution (critical 9.4)
- [CVE-2023-53941](https://insights.sbomify.com/CVE-2023-53941/): EasyPHP Webserver 14.1 Remote Code Execution (critical 9.3)
- [CVE-2023-53940](https://insights.sbomify.com/CVE-2023-53940/): Codigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown File (high 8.4)
- [CVE-2023-5394](https://insights.sbomify.com/CVE-2023-5394/): Memory corruption in Experion Server (high 7.4)
- [CVE-2023-53939](https://insights.sbomify.com/CVE-2023-53939/): TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter (medium 5.1)
- [CVE-2023-53938](https://insights.sbomify.com/CVE-2023-53938/): RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters (medium 5.1)
- [CVE-2023-53937](https://insights.sbomify.com/CVE-2023-53937/): Hubstaff 1.6.13 and 1.6.14 DLL Search Order Hijacking via wow64log Library (high 8.5)
- [CVE-2023-53936](https://insights.sbomify.com/CVE-2023-53936/): Cameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creation (medium 5.1)
- [CVE-2023-53935](https://insights.sbomify.com/CVE-2023-53935/): WBiz Desk 1.2 SQL Injection Vulnerability via ticket.php Parameter (medium 5.3)
- [CVE-2023-53934](https://insights.sbomify.com/CVE-2023-53934/): Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service (high 8.7)
- [CVE-2023-53933](https://insights.sbomify.com/CVE-2023-53933/): Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload (high 8.7)
- [CVE-2023-53932](https://insights.sbomify.com/CVE-2023-53932/): Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation (medium 5.1)
- [CVE-2023-53931](https://insights.sbomify.com/CVE-2023-53931/): Revive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced Settings (medium 5.1)
- [CVE-2023-53930](https://insights.sbomify.com/CVE-2023-53930/): ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability (high 7.1)
- [CVE-2023-5393](https://insights.sbomify.com/CVE-2023-5393/): Memory corruption in Experion Server (high 7.4)
- [CVE-2023-53929](https://insights.sbomify.com/CVE-2023-53929/): phpMyFAQ 3.1.12 CSV Injection via User Profile Export (medium 6.2)
- [CVE-2023-53928](https://insights.sbomify.com/CVE-2023-53928/): PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload (medium 5.1)
- [CVE-2023-53927](https://insights.sbomify.com/CVE-2023-53927/): PHPJabbers Simple CMS 5.0 Stored Cross-Site Scripting via Section Creation (medium 5.1)
- [CVE-2023-53926](https://insights.sbomify.com/CVE-2023-53926/): PHPJabbers Simple CMS 5.0 SQL Injection via Column Parameter (high 8.7)
- [CVE-2023-53925](https://insights.sbomify.com/CVE-2023-53925/): UliCMS 2023.1 Stored Cross-Site Scripting via SVG File Upload (medium 5.1)
- [CVE-2023-53924](https://insights.sbomify.com/CVE-2023-53924/): UliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar Upload (high 8.7)
- [CVE-2023-53923](https://insights.sbomify.com/CVE-2023-53923/): UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creation (critical 9.3)
- [CVE-2023-53922](https://insights.sbomify.com/CVE-2023-53922/): TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload (critical 9.3)
- [CVE-2023-53921](https://insights.sbomify.com/CVE-2023-53921/): SitemagicCMS 4.4.3 Remote Code Execution via Unrestricted File Upload (high 8.7)
- [CVE-2023-53920](https://insights.sbomify.com/CVE-2023-53920/): PodcastGenerator Stored Cross-Site Scripting via Podcast Title Field (medium 5.1)
- [CVE-2023-5392](https://insights.sbomify.com/CVE-2023-5392/): Information disclosure in C300 (high 7.5)
- [CVE-2023-53919](https://insights.sbomify.com/CVE-2023-53919/): PodcastGenerator Stored Cross-Site Scripting via Freebox Content Field (medium 5.1)
- [CVE-2023-53918](https://insights.sbomify.com/CVE-2023-53918/): PodcastGenerator Stored Cross-Site Scripting via Episode Title Field (medium 5.1)
- [CVE-2023-53917](https://insights.sbomify.com/CVE-2023-53917/): Affiliate Me 5.0.1 SQL Injection Vulnerability via Admin Panel (high 8.7)
- [CVE-2023-53916](https://insights.sbomify.com/CVE-2023-53916/): Zenphoto 1.6 Stored Cross-Site Scripting via User Postal Code Field (medium 5.1)
- [CVE-2023-53915](https://insights.sbomify.com/CVE-2023-53915/): Zenphoto 1.6 Stored Cross-Site Scripting via Album Description (medium 5.1)
- [CVE-2023-53914](https://insights.sbomify.com/CVE-2023-53914/): UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability (critical 9.3)
- [CVE-2023-53913](https://insights.sbomify.com/CVE-2023-53913/): Rukovoditel 3.3.1 CSV Injection via User Account Export (medium 6.2)
- [CVE-2023-53912](https://insights.sbomify.com/CVE-2023-53912/): USB Flash Drives Control 4.1.0.0 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2023-53911](https://insights.sbomify.com/CVE-2023-53911/): Textpattern CMS 4.8.8 Authenticated Stored Cross-Site Scripting via Article Excerpt (medium 5.1)
- [CVE-2023-53910](https://insights.sbomify.com/CVE-2023-53910/): WBCE CMS 1.6.1 Stored Cross-Site Scripting via Page Content (medium 5.1)
- [CVE-2023-5391](https://insights.sbomify.com/CVE-2023-5391/): Deserialization in EcoStruxure Power Monitoring Expert (critical 9.8)
- [CVE-2023-53909](https://insights.sbomify.com/CVE-2023-53909/): WBCE CMS 1.6.1 SVG File Content Cross-Site Scripting (medium 5.1)
- [CVE-2023-53908](https://insights.sbomify.com/CVE-2023-53908/): HiSecOS 04.0.01 Privilege Escalation via User Role Modification (high 8.7)
- [CVE-2023-53907](https://insights.sbomify.com/CVE-2023-53907/): Bludit < 3.13.0 Authenticated Arbitrary File Download via Backup Plugin (high 7.1)
- [CVE-2023-53906](https://insights.sbomify.com/CVE-2023-53906/): ProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page (medium 5.1)
- [CVE-2023-53905](https://insights.sbomify.com/CVE-2023-53905/): ProjectSend r1605 CSV Injection via User Account Export Functionality (medium 6.2)
- [CVE-2023-53904](https://insights.sbomify.com/CVE-2023-53904/): Xenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories (medium 5.1)
- [CVE-2023-53903](https://insights.sbomify.com/CVE-2023-53903/): WebsiteBaker 2.13.3 Stored Cross-Site Scripting via SVG File Upload (medium 5.1)
- [CVE-2023-53902](https://insights.sbomify.com/CVE-2023-53902/): WebsiteBaker 2.13.3 Directory Traversal via Media Delete Endpoint (high 7.0)
- [CVE-2023-53901](https://insights.sbomify.com/CVE-2023-53901/): WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability (high 7.1)
- [CVE-2023-53900](https://insights.sbomify.com/CVE-2023-53900/): Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload (medium 4.8)
- [CVE-2023-5390](https://insights.sbomify.com/CVE-2023-5390/): Path traversal in ControlEdge UOC (medium 5.3)
- [CVE-2023-53899](https://insights.sbomify.com/CVE-2023-53899/): PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection (medium 5.1)
- [CVE-2023-53898](https://insights.sbomify.com/CVE-2023-53898/): Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration (medium 5.1)
- [CVE-2023-53897](https://insights.sbomify.com/CVE-2023-53897/): Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments (medium 5.1)
- [CVE-2023-53896](https://insights.sbomify.com/CVE-2023-53896/): D-Link DAP-1325 Hardware A1 Unauthenticated Configuration Download (high 8.7)
- [CVE-2023-53895](https://insights.sbomify.com/CVE-2023-53895/): PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint (critical 9.3)
- [CVE-2023-53894](https://insights.sbomify.com/CVE-2023-53894/): phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerability (critical 9.3)
- [CVE-2023-53893](https://insights.sbomify.com/CVE-2023-53893/): Ateme TITAN File 3.9 Authenticated Server-Side Request Forgery Vulnerability (medium 5.3)
- [CVE-2023-53892](https://insights.sbomify.com/CVE-2023-53892/): Blackcat CMS 1.4 Remote Code Execution via Jquery Plugin Manager (high 8.6)
- [CVE-2023-53891](https://insights.sbomify.com/CVE-2023-53891/): Blackcat CMS 1.4 Stored Cross-Site Scripting via Page Modification (medium 5.1)
- [CVE-2023-53890](https://insights.sbomify.com/CVE-2023-53890/): Perch CMS 3.2 Stored Cross-Site Scripting via SVG File Upload (medium 5.1)
- [CVE-2023-5389](https://insights.sbomify.com/CVE-2023-5389/): Other in ControlEdge UOC (critical 9.1)
- [CVE-2023-53889](https://insights.sbomify.com/CVE-2023-53889/): Perch CMS 3.2 Remote Code Execution via Unrestricted File Upload (high 8.6)
- [CVE-2023-53888](https://insights.sbomify.com/CVE-2023-53888/): Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation (high 8.6)
- [CVE-2023-53887](https://insights.sbomify.com/CVE-2023-53887/): Zomplog 3.9 Cross-Site Scripting Vulnerability via Page Creation (medium 5.1)
- [CVE-2023-53886](https://insights.sbomify.com/CVE-2023-53886/): Xlight FTP Server 3.9.3.6 Stack Buffer Overflow Vulnerability via Execute Program (medium 5.1)
- [CVE-2023-53885](https://insights.sbomify.com/CVE-2023-53885/): Webutler v3.2 Remote Code Execution via Arbitrary File Upload (high 8.6)
- [CVE-2023-53884](https://insights.sbomify.com/CVE-2023-53884/): Webedition CMS v2.9.8.8 Stored Cross-Site Scripting via SVG Upload (medium 5.1)
- [CVE-2023-53883](https://insights.sbomify.com/CVE-2023-53883/): Webedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation (high 8.6)
- [CVE-2023-53882](https://insights.sbomify.com/CVE-2023-53882/): JLex GuestBook 1.6.4 Reflected Cross-Site Scripting via URL Parameter (medium 5.1)
- [CVE-2023-53881](https://insights.sbomify.com/CVE-2023-53881/): ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP (critical 9.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/145/