# Vulnerabilities published in 2023


- [CVE-2023-52328](https://insights.sbomify.com/CVE-2023-52328/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-52327](https://insights.sbomify.com/CVE-2023-52327/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-52326](https://insights.sbomify.com/CVE-2023-52326/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-52325](https://insights.sbomify.com/CVE-2023-52325/): Code injection in Trend Micro Apex Central (high 7.5)
- [CVE-2023-52324](https://insights.sbomify.com/CVE-2023-52324/): File upload in Trend Micro Apex Central (high 8.8)
- [CVE-2023-52323](https://insights.sbomify.com/CVE-2023-52323/): PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption (medium 5.9)
- [CVE-2023-52322](https://insights.sbomify.com/CVE-2023-52322/): Cross-site scripting in spip:spip (medium 6.1)
- [CVE-2023-5232](https://insights.sbomify.com/CVE-2023-5232/): Font Awesome More Icons <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-52314](https://insights.sbomify.com/CVE-2023-52314/): Command injection in convert_shape_compare (critical 9.6)
- [CVE-2023-52313](https://insights.sbomify.com/CVE-2023-52313/): FPE in paddle.argmin and paddle.argmax (medium 4.7)
- [CVE-2023-52312](https://insights.sbomify.com/CVE-2023-52312/): Null pointer dereference in paddle.crop (medium 4.7)
- [CVE-2023-52311](https://insights.sbomify.com/CVE-2023-52311/): Command injection in _wget_download (critical 9.6)
- [CVE-2023-52310](https://insights.sbomify.com/CVE-2023-52310/): Command injection in get_online_pass_interval (critical 9.6)
- [CVE-2023-5231](https://insights.sbomify.com/CVE-2023-5231/): Magic Action Box <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-52309](https://insights.sbomify.com/CVE-2023-52309/): Heap buffer overflow in paddle.repeat_interleave (high 8.2)
- [CVE-2023-52308](https://insights.sbomify.com/CVE-2023-52308/): FPE in paddle.amin (medium 4.7)
- [CVE-2023-52307](https://insights.sbomify.com/CVE-2023-52307/): Stack overflow in paddle.linalg.lu_unpack (high 8.2)
- [CVE-2023-52306](https://insights.sbomify.com/CVE-2023-52306/): FPE in paddle.lerp (medium 4.7)
- [CVE-2023-52305](https://insights.sbomify.com/CVE-2023-52305/): FPE in paddle.topk (medium 4.7)
- [CVE-2023-52304](https://insights.sbomify.com/CVE-2023-52304/): Stack overflow in paddle.searchsorted (high 8.2)
- [CVE-2023-52303](https://insights.sbomify.com/CVE-2023-52303/): Segfault in paddle.put_along_axis (medium 4.7)
- [CVE-2023-52302](https://insights.sbomify.com/CVE-2023-52302/): Segfault in paddle.nextafter (medium 4.7)
- [CVE-2023-5230](https://insights.sbomify.com/CVE-2023-5230/): TM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-52296](https://insights.sbomify.com/CVE-2023-52296/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 5.3)
- [CVE-2023-52292](https://insights.sbomify.com/CVE-2023-52292/): IBM Sterling File Gateway cross-site scripting (medium 6.4)
- [CVE-2023-52291](https://insights.sbomify.com/CVE-2023-52291/): Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution (high 8.8)
- [CVE-2023-52290](https://insights.sbomify.com/CVE-2023-52290/): Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability (high 8.1)
- [CVE-2023-5229](https://insights.sbomify.com/CVE-2023-5229/): E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping (medium 4.8)
- [CVE-2023-52289](https://insights.sbomify.com/CVE-2023-52289/): Path traversal in flaskcode (high 7.5)
- [CVE-2023-52288](https://insights.sbomify.com/CVE-2023-52288/): Path traversal in flaskcode (high 7.5)
- [CVE-2023-52286](https://insights.sbomify.com/CVE-2023-52286/): Information disclosure in tencent:tencent distributed sql (high 7.5)
- [CVE-2023-52285](https://insights.sbomify.com/CVE-2023-52285/): SQL injection in lrx0014:examsys (high 7.5)
- [CVE-2023-52284](https://insights.sbomify.com/CVE-2023-52284/): Memory corruption in bytecodealliance:webassembly micro runtime (medium 5.5)
- [CVE-2023-5228](https://insights.sbomify.com/CVE-2023-5228/): User Registration < 3.0.4.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-52277](https://insights.sbomify.com/CVE-2023-52277/): Memory corruption in royalapps:royaltsx (high 7.8)
- [CVE-2023-52275](https://insights.sbomify.com/CVE-2023-52275/): Missing authorization in tecno-mobile:camon x firmware (low 2.1)
- [CVE-2023-52274](https://insights.sbomify.com/CVE-2023-52274/): Cross-site scripting in yzmcms:yzmcms (medium 6.1)
- [CVE-2023-52271](https://insights.sbomify.com/CVE-2023-52271/): Missing authorization in topazevolution:antifraud (medium 6.5)
- [CVE-2023-5227](https://insights.sbomify.com/CVE-2023-5227/): Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq (medium 6.5)
- [CVE-2023-52269](https://insights.sbomify.com/CVE-2023-52269/): Cross-site scripting in mdaemon:securitygateway (medium 4.8)
- [CVE-2023-52268](https://insights.sbomify.com/CVE-2023-52268/): The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session t (critical 9.1)
- [CVE-2023-52267](https://insights.sbomify.com/CVE-2023-52267/): Memory corruption in hongliuliao:ehttp (high 7.5)
- [CVE-2023-52266](https://insights.sbomify.com/CVE-2023-52266/): Use after free in hongliuliao:ehttp (high 7.5)
- [CVE-2023-52265](https://insights.sbomify.com/CVE-2023-52265/): Cross-site scripting in idurarapp:idurar (medium 5.4)
- [CVE-2023-52264](https://insights.sbomify.com/CVE-2023-52264/): Cross-site scripting in thirtybees:bees blog (medium 6.1)
- [CVE-2023-52263](https://insights.sbomify.com/CVE-2023-52263/): Open redirect in brave:browser (medium 6.1)
- [CVE-2023-52262](https://insights.sbomify.com/CVE-2023-52262/): Code injection in outdoorbits:little backup box (critical 9.8)
- [CVE-2023-5226](https://insights.sbomify.com/CVE-2023-5226/): Improper Control of Generation of Code ('Code Injection') in GitLab (medium 4.8)
- [CVE-2023-52257](https://insights.sbomify.com/CVE-2023-52257/): LogoBee 0.2 allows updates.php?id= XSS. (medium 6.1)
- [CVE-2023-52252](https://insights.sbomify.com/CVE-2023-52252/): Misconfiguration in unifiedremote:unified remote (critical 9.8)
- [CVE-2023-52251](https://insights.sbomify.com/CVE-2023-52251/): Code injection in provectus:ui (high 8.8)
- [CVE-2023-52240](https://insights.sbomify.com/CVE-2023-52240/): Cross-site scripting in kantega-sso:kantega saml sso oidc kerberos single sign-on (medium 6.1)
- [CVE-2023-52239](https://insights.sbomify.com/CVE-2023-52239/): XML external entity in magicsoftware:magic xpi integration platform (medium 6.5)
- [CVE-2023-52238](https://insights.sbomify.com/CVE-2023-52238/): Information disclosure in RUGGEDCOM RST2228 (low 2.3)
- [CVE-2023-52237](https://insights.sbomify.com/CVE-2023-52237/): Information disclosure in RUGGEDCOM M2100 (high 7.7)
- [CVE-2023-52236](https://insights.sbomify.com/CVE-2023-52236/): Weak cryptography in RUGGEDCOM M2100 (medium 6.1)
- [CVE-2023-52235](https://insights.sbomify.com/CVE-2023-52235/): SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a re (high 8.8)
- [CVE-2023-52234](https://insights.sbomify.com/CVE-2023-52234/): WordPress Booster Elite for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2023-52233](https://insights.sbomify.com/CVE-2023-52233/): WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability (high 8.6)
- [CVE-2023-52232](https://insights.sbomify.com/CVE-2023-52232/): WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Authenticated Arbitrary Post/Page Deletion Vulnerability (medium 6.5)
- [CVE-2023-52231](https://insights.sbomify.com/CVE-2023-52231/): WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2023-52230](https://insights.sbomify.com/CVE-2023-52230/): Missing authorization in Booster Plus for WooCommerce (medium 6.5)
- [CVE-2023-5223](https://insights.sbomify.com/CVE-2023-5223/): HimitZH HOJ Topic sandbox (medium 6.3)
- [CVE-2023-52229](https://insights.sbomify.com/CVE-2023-52229/): WordPress Word Replacer Pro plugin <= 1.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-52228](https://insights.sbomify.com/CVE-2023-52228/): WordPress Beds24 Online Booking plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2023-52227](https://insights.sbomify.com/CVE-2023-52227/): WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-52226](https://insights.sbomify.com/CVE-2023-52226/): WordPress Advanced Flamingo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-52225](https://insights.sbomify.com/CVE-2023-52225/): WordPress Taggbox Plugin <= 3.1 is vulnerable to PHP Object Injection (critical 10.0)
- [CVE-2023-52224](https://insights.sbomify.com/CVE-2023-52224/): WordPress Revolut Gateway for WooCommerce plugin <= 4.9.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-52223](https://insights.sbomify.com/CVE-2023-52223/): WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-52222](https://insights.sbomify.com/CVE-2023-52222/): WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52221](https://insights.sbomify.com/CVE-2023-52221/): WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.1 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-52220](https://insights.sbomify.com/CVE-2023-52220/): WordPress MonsterInsights plugin <= 8.21.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-5222](https://insights.sbomify.com/CVE-2023-5222/): Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password (medium 6.3)
- [CVE-2023-52219](https://insights.sbomify.com/CVE-2023-52219/): WordPress Gecka Terms Thumbnails Plugin <= 1.1 is vulnerable to PHP Object Injection (critical 9.9)
- [CVE-2023-52218](https://insights.sbomify.com/CVE-2023-52218/): WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection (critical 10.0)
- [CVE-2023-52217](https://insights.sbomify.com/CVE-2023-52217/): WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-52216](https://insights.sbomify.com/CVE-2023-52216/): WordPress JS & CSS Script Optimizer Plugin <= 0.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-52215](https://insights.sbomify.com/CVE-2023-52215/): WordPress Barcode Scanner with Inventory & Order Manager Plugin <=1.5.1 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-52214](https://insights.sbomify.com/CVE-2023-52214/): WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-52213](https://insights.sbomify.com/CVE-2023-52213/): WordPress Rate Star Review Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-52212](https://insights.sbomify.com/CVE-2023-52212/): WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-52211](https://insights.sbomify.com/CVE-2023-52211/): WordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-52210](https://insights.sbomify.com/CVE-2023-52210/): WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-5221](https://insights.sbomify.com/CVE-2023-5221/): ForU CMS index.php code injection (medium 4.7)
- [CVE-2023-52209](https://insights.sbomify.com/CVE-2023-52209/): WordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerability (high 8.0)
- [CVE-2023-52208](https://insights.sbomify.com/CVE-2023-52208/): WordPress Constant Contact Forms Plugin <= 2.4.2 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-52207](https://insights.sbomify.com/CVE-2023-52207/): WordPress HTML5 MP3 Player with Playlist Free Plugin <= 3.0.0 is vulnerable to PHP Object Injection (critical 9.1)
- [CVE-2023-52206](https://insights.sbomify.com/CVE-2023-52206/): WordPress Page Builder: Live Composer Plugin <= 1.5.25 is vulnerable to PHP Object Injection (high 7.7)
- [CVE-2023-52205](https://insights.sbomify.com/CVE-2023-52205/): WordPress HTML5 SoundCloud Player Plugin <= 2.8.0 is vulnerable to PHP Object Injection (critical 9.1)
- [CVE-2023-52204](https://insights.sbomify.com/CVE-2023-52204/): WordPress Randomize Plugin <= 1.4.3 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-52203](https://insights.sbomify.com/CVE-2023-52203/): WordPress CformsII Plugin <= 15.0.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-52202](https://insights.sbomify.com/CVE-2023-52202/): WordPress HTML5 MP3 Player with Folder Feedburner Plugin <= 2.8.0 is vulnerable to PHP Object Injection (critical 9.1)
- [CVE-2023-52201](https://insights.sbomify.com/CVE-2023-52201/): WordPress pTypeConverter Plugin <= 0.2.8.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-52200](https://insights.sbomify.com/CVE-2023-52200/): WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection (critical 9.6)
- [CVE-2023-52199](https://insights.sbomify.com/CVE-2023-52199/): WordPress ActivityPub plugin <= 1.0.5 - Unauthenticated Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-52198](https://insights.sbomify.com/CVE-2023-52198/): WordPress Private Google Calendars Plugin <= 20231125 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-52197](https://insights.sbomify.com/CVE-2023-52197/): WordPress Ads Invalid Click Protection Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-52196](https://insights.sbomify.com/CVE-2023-52196/): WordPress CPT Bootstrap Carousel Plugin <= 1.12 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-52195](https://insights.sbomify.com/CVE-2023-52195/): WordPress Posts to Page Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/162/