# Vulnerabilities published in 2023


- [CVE-2023-5209](https://insights.sbomify.com/CVE-2023-5209/): Bookly < 22.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-52086](https://insights.sbomify.com/CVE-2023-52086/): File upload in startutorial:php backend for resumable.js (high 8.1)
- [CVE-2023-52085](https://insights.sbomify.com/CVE-2023-52085/): Winter CMS Local File Inclusion through Server Side Template Injection (low 3.3)
- [CVE-2023-52084](https://insights.sbomify.com/CVE-2023-52084/): Winter CMS Stored XSS through Backend ColorPicker FormWidget (low 2.0)
- [CVE-2023-52083](https://insights.sbomify.com/CVE-2023-52083/): Stored XSS through privileged upload of Media Manager file followed by renaming (low 2.0)
- [CVE-2023-52082](https://insights.sbomify.com/CVE-2023-52082/): Lychee is vulnerable to an SQL Injection in explain DB queries. (high 8.8)
- [CVE-2023-52081](https://insights.sbomify.com/CVE-2023-52081/): ewen-lbh/ffcss late-Unicode normalization vulnerability (medium 5.3)
- [CVE-2023-52080](https://insights.sbomify.com/CVE-2023-52080/): IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. (high 7.7)
- [CVE-2023-52079](https://insights.sbomify.com/CVE-2023-52079/): Conversion of property names to strings can trigger infinite recursion (medium 6.8)
- [CVE-2023-52077](https://insights.sbomify.com/CVE-2023-52077/): External apps using tokens issued by administrators and moderators can call admin APIs (high 8.9)
- [CVE-2023-52076](https://insights.sbomify.com/CVE-2023-52076/): Remote Code Execution Vulnerability in Atril's EPUB ebook parsing (high 8.5)
- [CVE-2023-52075](https://insights.sbomify.com/CVE-2023-52075/): ReVanced API vulnerable to Denial of Service due to lack of error caching (high 7.5)
- [CVE-2023-52074](https://insights.sbomify.com/CVE-2023-52074/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2023-52073](https://insights.sbomify.com/CVE-2023-52073/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2023-52072](https://insights.sbomify.com/CVE-2023-52072/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2023-52070](https://insights.sbomify.com/CVE-2023-52070/): Memory corruption in jfree:jfreechart (high 8.4)
- [CVE-2023-5207](https://insights.sbomify.com/CVE-2023-5207/): Execution with Unnecessary Privileges in GitLab (high 8.2)
- [CVE-2023-52069](https://insights.sbomify.com/CVE-2023-52069/): Cross-site scripting in kodcloud:kodbox (medium 5.4)
- [CVE-2023-52068](https://insights.sbomify.com/CVE-2023-52068/): Cross-site scripting in kodcloud:kodbox (medium 6.1)
- [CVE-2023-52066](https://insights.sbomify.com/CVE-2023-52066/): http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter. (high 7.2)
- [CVE-2023-52064](https://insights.sbomify.com/CVE-2023-52064/): SQL injection in wuzhicms:wuzhicms (critical 9.8)
- [CVE-2023-52060](https://insights.sbomify.com/CVE-2023-52060/): Cross-site request forgery in gestsup:gestsup (medium 4.3)
- [CVE-2023-52059](https://insights.sbomify.com/CVE-2023-52059/): Cross-site scripting in gestsup:gestsup (medium 5.4)
- [CVE-2023-5205](https://insights.sbomify.com/CVE-2023-5205/): Add Custom Body Class <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-52048](https://insights.sbomify.com/CVE-2023-52048/): Cross-site scripting in ruoyi:ruoyi (medium 4.7)
- [CVE-2023-52047](https://insights.sbomify.com/CVE-2023-52047/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2023-52046](https://insights.sbomify.com/CVE-2023-52046/): Cross-site scripting in webmin:webmin (medium 4.8)
- [CVE-2023-52045](https://insights.sbomify.com/CVE-2023-52045/): Cross-site scripting in std42:elfinder (medium 6.1)
- [CVE-2023-52044](https://insights.sbomify.com/CVE-2023-52044/): File upload in std42:elfinder (critical 9.8)
- [CVE-2023-52043](https://insights.sbomify.com/CVE-2023-52043/): An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Pas (high 8.1)
- [CVE-2023-52042](https://insights.sbomify.com/CVE-2023-52042/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-52041](https://insights.sbomify.com/CVE-2023-52041/): Other in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-52040](https://insights.sbomify.com/CVE-2023-52040/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-5204](https://insights.sbomify.com/CVE-2023-5204/): AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response (critical 9.8)
- [CVE-2023-52039](https://insights.sbomify.com/CVE-2023-52039/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-52038](https://insights.sbomify.com/CVE-2023-52038/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-52032](https://insights.sbomify.com/CVE-2023-52032/): Command injection in totolink:ex1200t firmware (critical 9.8)
- [CVE-2023-52031](https://insights.sbomify.com/CVE-2023-52031/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-52030](https://insights.sbomify.com/CVE-2023-52030/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-5203](https://insights.sbomify.com/CVE-2023-5203/): WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection (high 7.5)
- [CVE-2023-52029](https://insights.sbomify.com/CVE-2023-52029/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-52028](https://insights.sbomify.com/CVE-2023-52028/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-52027](https://insights.sbomify.com/CVE-2023-52027/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-52026](https://insights.sbomify.com/CVE-2023-52026/): Command injection in totolink:ex1800t firmware (critical 9.8)
- [CVE-2023-5201](https://insights.sbomify.com/CVE-2023-5201/): OpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode (critical 9.9)
- [CVE-2023-5200](https://insights.sbomify.com/CVE-2023-5200/): flowpaper <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5199](https://insights.sbomify.com/CVE-2023-5199/): PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode (critical 9.9)
- [CVE-2023-51987](https://insights.sbomify.com/CVE-2023-51987/): Auth bypass in dlink:dir-822 firmware (critical 9.8)
- [CVE-2023-51984](https://insights.sbomify.com/CVE-2023-51984/): Command injection in dlink:dir-822 firmware (critical 9.8)
- [CVE-2023-51982](https://insights.sbomify.com/CVE-2023-51982/): CrateDB authentication bypass vulnerability (critical 9.8)
- [CVE-2023-5198](https://insights.sbomify.com/CVE-2023-5198/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2023-51978](https://insights.sbomify.com/CVE-2023-51978/): SQL injection in phpgurukul:art gallery management system (high 8.1)
- [CVE-2023-51972](https://insights.sbomify.com/CVE-2023-51972/): Command injection in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51971](https://insights.sbomify.com/CVE-2023-51971/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51970](https://insights.sbomify.com/CVE-2023-51970/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-5197](https://insights.sbomify.com/CVE-2023-5197/): Use-after-free in Linux kernel's netfilter: nf_tables component (high 7.8)
- [CVE-2023-51969](https://insights.sbomify.com/CVE-2023-51969/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51968](https://insights.sbomify.com/CVE-2023-51968/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51967](https://insights.sbomify.com/CVE-2023-51967/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51966](https://insights.sbomify.com/CVE-2023-51966/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51965](https://insights.sbomify.com/CVE-2023-51965/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51964](https://insights.sbomify.com/CVE-2023-51964/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51963](https://insights.sbomify.com/CVE-2023-51963/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51962](https://insights.sbomify.com/CVE-2023-51962/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51961](https://insights.sbomify.com/CVE-2023-51961/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51960](https://insights.sbomify.com/CVE-2023-51960/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-5196](https://insights.sbomify.com/CVE-2023-5196/): DoS via Channel Notification Properties (medium 6.5)
- [CVE-2023-51959](https://insights.sbomify.com/CVE-2023-51959/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51958](https://insights.sbomify.com/CVE-2023-51958/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51957](https://insights.sbomify.com/CVE-2023-51957/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51956](https://insights.sbomify.com/CVE-2023-51956/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51955](https://insights.sbomify.com/CVE-2023-51955/): Memory corruption in tenda:ax1803 firmware (medium 6.5)
- [CVE-2023-51954](https://insights.sbomify.com/CVE-2023-51954/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51953](https://insights.sbomify.com/CVE-2023-51953/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51952](https://insights.sbomify.com/CVE-2023-51952/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2023-51951](https://insights.sbomify.com/CVE-2023-51951/): SQL injection in stock management system project:stock management system (critical 9.8)
- [CVE-2023-5195](https://insights.sbomify.com/CVE-2023-5195/): A team member can soft delete other teams that they are not part of (medium 6.5)
- [CVE-2023-51949](https://insights.sbomify.com/CVE-2023-51949/): Cross-site request forgery in verydows:verydows (high 8.8)
- [CVE-2023-51948](https://insights.sbomify.com/CVE-2023-51948/): Information disclosure in actidata:actinas sl 2u-8 rdx firmware (high 7.5)
- [CVE-2023-51947](https://insights.sbomify.com/CVE-2023-51947/): Missing authorization in actidata:actinas sl 2u-8 rdx firmware (critical 9.1)
- [CVE-2023-51946](https://insights.sbomify.com/CVE-2023-51946/): Cross-site scripting in actidata:actinas sl 2u-8 rdx firmware (medium 6.1)
- [CVE-2023-5194](https://insights.sbomify.com/CVE-2023-5194/): A system/user manager can demote / deactivate another manager (low 2.7)
- [CVE-2023-51939](https://insights.sbomify.com/CVE-2023-51939/): Other in relic project:relic (high 8.8)
- [CVE-2023-51931](https://insights.sbomify.com/CVE-2023-51931/): Denial of service in alanclarke:urlite (high 7.5)
- [CVE-2023-5193](https://insights.sbomify.com/CVE-2023-5193/): System Role with manage posts permission can read posts of Direct Messages (medium 4.9)
- [CVE-2023-51928](https://insights.sbomify.com/CVE-2023-51928/): File upload in yonyou:yonbip (critical 9.8)
- [CVE-2023-51927](https://insights.sbomify.com/CVE-2023-51927/): SQL injection in yonyou:yonbip (critical 9.8)
- [CVE-2023-51926](https://insights.sbomify.com/CVE-2023-51926/): Path traversal in yonyou:yonbip (high 7.5)
- [CVE-2023-51925](https://insights.sbomify.com/CVE-2023-51925/): File upload in yonyou:yonbip (critical 9.8)
- [CVE-2023-51924](https://insights.sbomify.com/CVE-2023-51924/): File upload in yonyou:yonbip (critical 9.8)
- [CVE-2023-5192](https://insights.sbomify.com/CVE-2023-5192/): Excessive Data Query Operations in a Large Data Table in pimcore/demo (medium 6.1)
- [CVE-2023-51906](https://insights.sbomify.com/CVE-2023-51906/): Code injection in yonyou:yonbip (critical 9.8)
- [CVE-2023-5190](https://insights.sbomify.com/CVE-2023-5190/): Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page (medium 6.1)
- [CVE-2023-51892](https://insights.sbomify.com/CVE-2023-51892/): Code injection in weaver:e-cology (critical 9.8)
- [CVE-2023-51890](https://insights.sbomify.com/CVE-2023-51890/): Denial of service in ctan:mathtex (high 7.5)
- [CVE-2023-5189](https://insights.sbomify.com/CVE-2023-5189/): Hub: insecure galaxy-importer tarfile extraction (medium 6.3)
- [CVE-2023-51889](https://insights.sbomify.com/CVE-2023-51889/): Memory corruption in ctan:mathtex (critical 9.8)
- [CVE-2023-51888](https://insights.sbomify.com/CVE-2023-51888/): Memory corruption in ctan:mathtex (high 7.5)
- [CVE-2023-51887](https://insights.sbomify.com/CVE-2023-51887/): Command injection in ctan:mathtex (critical 9.8)
- [CVE-2023-51886](https://insights.sbomify.com/CVE-2023-51886/): Memory corruption in ctan:mathtex (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/164/