# Vulnerabilities published in 2023


- [CVE-2023-5153](https://insights.sbomify.com/CVE-2023-5153/): D-Link DAR-8000 querysql.php sql injection (medium 6.3)
- [CVE-2023-51529](https://insights.sbomify.com/CVE-2023-51529/): WordPress HT Mega Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-51528](https://insights.sbomify.com/CVE-2023-51528/): WordPress GPT3 AI Content Writer Plugin <= 1.8.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-51527](https://insights.sbomify.com/CVE-2023-51527/): WordPress GPT3 AI Content Writer Plugin <= 1.8.2 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-51526](https://insights.sbomify.com/CVE-2023-51526/): WordPress Simple Staff List plugin <= 2.2.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-51525](https://insights.sbomify.com/CVE-2023-51525/): WordPress WP Simple Booking Calendar plugin <= 2.0.8.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-51524](https://insights.sbomify.com/CVE-2023-51524/): WordPress weForms plugin <= 1.6.18 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-51523](https://insights.sbomify.com/CVE-2023-51523/): WordPress WooCommerce Easy Duplicate Product plugin <= 0.3.0.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-51522](https://insights.sbomify.com/CVE-2023-51522/): WordPress Paid Membership Subscriptions plugin <= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-51521](https://insights.sbomify.com/CVE-2023-51521/): WordPress Quiz And Survey Master plugin <= 8.1.18 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-51520](https://insights.sbomify.com/CVE-2023-51520/): WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-5152](https://insights.sbomify.com/CVE-2023-5152/): D-Link DAR-7000/DAR-8000 importexport.php sql injection (medium 6.3)
- [CVE-2023-51519](https://insights.sbomify.com/CVE-2023-51519/): Missing authorization in Slider by Soliloquy (medium 4.3)
- [CVE-2023-51518](https://insights.sbomify.com/CVE-2023-51518/): Apache James server: Privilege escalation via JMX pre-authentication deserialisation (critical 9.8)
- [CVE-2023-51517](https://insights.sbomify.com/CVE-2023-51517/): WordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open Redirection (medium 4.1)
- [CVE-2023-51516](https://insights.sbomify.com/CVE-2023-51516/): Missing authorization in Business Directory Plugin (medium 5.4)
- [CVE-2023-51515](https://insights.sbomify.com/CVE-2023-51515/): WordPress Uncode Core plugin <= 2.8.8 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-51514](https://insights.sbomify.com/CVE-2023-51514/): WordPress CBX Bookmark & Favorite Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51513](https://insights.sbomify.com/CVE-2023-51513/): WordPress Geo Controller plugin <= 8.5.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2023-51512](https://insights.sbomify.com/CVE-2023-51512/): WordPress Product Table by WBW plugin <= 1.8.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-51511](https://insights.sbomify.com/CVE-2023-51511/): WordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification Vulnerability (medium 6.5)
- [CVE-2023-51510](https://insights.sbomify.com/CVE-2023-51510/): WordPress Export Media URLs plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-5151](https://insights.sbomify.com/CVE-2023-5151/): D-Link DAR-8000 autheditpwd.php sql injection (medium 6.3)
- [CVE-2023-51509](https://insights.sbomify.com/CVE-2023-51509/): WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-51508](https://insights.sbomify.com/CVE-2023-51508/): WordPress Database Cleaner Plugin <= 0.9.8 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-51507](https://insights.sbomify.com/CVE-2023-51507/): WordPress Quiz And Survey Master plugin <= 8.1.16 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51506](https://insights.sbomify.com/CVE-2023-51506/): WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.5)
- [CVE-2023-51505](https://insights.sbomify.com/CVE-2023-51505/): WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection (critical 10.0)
- [CVE-2023-51504](https://insights.sbomify.com/CVE-2023-51504/): WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51503](https://insights.sbomify.com/CVE-2023-51503/): WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR) (medium 5.9)
- [CVE-2023-51502](https://insights.sbomify.com/CVE-2023-51502/): WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) (high 7.5)
- [CVE-2023-51501](https://insights.sbomify.com/CVE-2023-51501/): WordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-51500](https://insights.sbomify.com/CVE-2023-51500/): WordPress Uncode Core plugin <= 2.8.8 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2023-5150](https://insights.sbomify.com/CVE-2023-5150/): D-Link DAR-7000/DAR-8000 web.php unrestricted upload (medium 6.3)
- [CVE-2023-51499](https://insights.sbomify.com/CVE-2023-51499/): WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-51498](https://insights.sbomify.com/CVE-2023-51498/): WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51497](https://insights.sbomify.com/CVE-2023-51497/): WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-51496](https://insights.sbomify.com/CVE-2023-51496/): WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51495](https://insights.sbomify.com/CVE-2023-51495/): WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-51494](https://insights.sbomify.com/CVE-2023-51494/): WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51493](https://insights.sbomify.com/CVE-2023-51493/): WordPress Custom Post Carousels with Owl Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51492](https://insights.sbomify.com/CVE-2023-51492/): WordPress If-So Dynamic Content Personalization Plugin <= 1.6.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51491](https://insights.sbomify.com/CVE-2023-51491/): WordPress Depicter Slider plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-51490](https://insights.sbomify.com/CVE-2023-51490/): WordPress Defender Security Plugin <= 4.1.0 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-5149](https://insights.sbomify.com/CVE-2023-5149/): D-Link DAR-7000 userattestation.php unrestricted upload (medium 6.3)
- [CVE-2023-51489](https://insights.sbomify.com/CVE-2023-51489/): WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-51488](https://insights.sbomify.com/CVE-2023-51488/): WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-51487](https://insights.sbomify.com/CVE-2023-51487/): Cross-site request forgery in ARI Stream Quiz (medium 5.4)
- [CVE-2023-51486](https://insights.sbomify.com/CVE-2023-51486/): Cross-site request forgery in WooCommerce PDF Invoice Builder (medium 5.4)
- [CVE-2023-51485](https://insights.sbomify.com/CVE-2023-51485/): WordPress Pay with Vipps for WooCommerce Plugin <= 1.14.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51484](https://insights.sbomify.com/CVE-2023-51484/): WordPress Login as User or Customer plugin <= 3.8 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2023-51483](https://insights.sbomify.com/CVE-2023-51483/): WordPress WP Frontend Profile plugin <= 1.3.1 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2023-51482](https://insights.sbomify.com/CVE-2023-51482/): WordPress Eazy Plugin Manager plugin <= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability (critical 9.9)
- [CVE-2023-51481](https://insights.sbomify.com/CVE-2023-51481/): WordPress Local Delivery Drivers for WooCommerce plugin <= 1.9.0 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2023-51480](https://insights.sbomify.com/CVE-2023-51480/): WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-5148](https://insights.sbomify.com/CVE-2023-5148/): D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload (medium 6.3)
- [CVE-2023-51479](https://insights.sbomify.com/CVE-2023-51479/): WordPress Build App Online plugin <= 1.0.19 - Authenticated Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-51478](https://insights.sbomify.com/CVE-2023-51478/): WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2023-51477](https://insights.sbomify.com/CVE-2023-51477/): WordPress BuddyBoss Theme theme <= 2.4.60 - Unauth. Arbitrary WordPress Settings Change vulnerability (critical 9.8)
- [CVE-2023-51476](https://insights.sbomify.com/CVE-2023-51476/): WordPress WP MLM Unilevel plugin <= 4.0 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2023-51475](https://insights.sbomify.com/CVE-2023-51475/): WordPress WP MLM Unilevel Plugin <= 4.0 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-51474](https://insights.sbomify.com/CVE-2023-51474/): WordPress TerraClassifieds plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability (high 8.8)
- [CVE-2023-51473](https://insights.sbomify.com/CVE-2023-51473/): WordPress TerraClassifieds Plugin <= 2.0.3 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-51472](https://insights.sbomify.com/CVE-2023-51472/): WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2023-51471](https://insights.sbomify.com/CVE-2023-51471/): WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerability (high 8.2)
- [CVE-2023-51470](https://insights.sbomify.com/CVE-2023-51470/): WordPress Rencontre – Dating Site Plugin <= 3.11.1 is vulnerable to PHP Object Injection (critical 9.9)
- [CVE-2023-5147](https://insights.sbomify.com/CVE-2023-5147/): D-Link DAR-7000 updateos.php unrestricted upload (medium 6.3)
- [CVE-2023-51469](https://insights.sbomify.com/CVE-2023-51469/): WordPress Checkout Mestres WP Plugin <= 7.1.9.6 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-51468](https://insights.sbomify.com/CVE-2023-51468/): WordPress Rencontre – Dating Site Plugin <= 3.10.1 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-51467](https://insights.sbomify.com/CVE-2023-51467/): Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability (critical 9.8)
- [CVE-2023-51464](https://insights.sbomify.com/CVE-2023-51464/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-51463](https://insights.sbomify.com/CVE-2023-51463/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-51462](https://insights.sbomify.com/CVE-2023-51462/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-51461](https://insights.sbomify.com/CVE-2023-51461/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-51460](https://insights.sbomify.com/CVE-2023-51460/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-5146](https://insights.sbomify.com/CVE-2023-5146/): D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload (medium 6.3)
- [CVE-2023-51459](https://insights.sbomify.com/CVE-2023-51459/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-51458](https://insights.sbomify.com/CVE-2023-51458/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-51457](https://insights.sbomify.com/CVE-2023-51457/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-51456](https://insights.sbomify.com/CVE-2023-51456/): Memory corruption in Matrice 300 (medium 6.8)
- [CVE-2023-51455](https://insights.sbomify.com/CVE-2023-51455/): Memory corruption in Matrice 300 (medium 6.8)
- [CVE-2023-51454](https://insights.sbomify.com/CVE-2023-51454/): Memory corruption in Matrice 300 (medium 6.8)
- [CVE-2023-51453](https://insights.sbomify.com/CVE-2023-51453/): Memory corruption in Matrice 300 (low 3.0)
- [CVE-2023-51452](https://insights.sbomify.com/CVE-2023-51452/): Memory corruption in Matrice 300 (low 3.0)
- [CVE-2023-51451](https://insights.sbomify.com/CVE-2023-51451/): SSRF in symbolicator via invalid protocol (medium 4.3)
- [CVE-2023-51450](https://insights.sbomify.com/CVE-2023-51450/): baserCMS OS command injection vulnerability in Installer (medium 5.6)
- [CVE-2023-5145](https://insights.sbomify.com/CVE-2023-5145/): D-Link DAR-7000 licence.php unrestricted upload (medium 6.3)
- [CVE-2023-51449](https://insights.sbomify.com/CVE-2023-51449/): Make the `/file` secure against file traversal attacks (medium 5.6)
- [CVE-2023-51448](https://insights.sbomify.com/CVE-2023-51448/): SQL Injection vulnerability when managing SNMP Notification Receivers (high 8.8)
- [CVE-2023-51447](https://insights.sbomify.com/CVE-2023-51447/): Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads (medium 6.3)
- [CVE-2023-51446](https://insights.sbomify.com/CVE-2023-51446/): GLPI LDAP Injection during authentication (medium 5.9)
- [CVE-2023-51445](https://insights.sbomify.com/CVE-2023-51445/): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API (medium 4.8)
- [CVE-2023-51444](https://insights.sbomify.com/CVE-2023-51444/): GeoServer arbitrary file upload vulnerability in REST Coverage Store API (high 7.2)
- [CVE-2023-51443](https://insights.sbomify.com/CVE-2023-51443/): FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation (high 7.5)
- [CVE-2023-51442](https://insights.sbomify.com/CVE-2023-51442/): Authentication bypass vulnerability in navidrome's subsonic endpoint (high 8.6)
- [CVE-2023-51441](https://insights.sbomify.com/CVE-2023-51441/): Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API (high 7.2)
- [CVE-2023-51440](https://insights.sbomify.com/CVE-2023-51440/): Denial of service in SIMATIC CP 343-1 (high 7.5)
- [CVE-2023-5144](https://insights.sbomify.com/CVE-2023-5144/): D-Link DAR-7000/DAR-8000 updateos.php unrestricted upload (medium 6.3)
- [CVE-2023-51439](https://insights.sbomify.com/CVE-2023-51439/): Memory corruption in JT2Go (high 7.8)
- [CVE-2023-51438](https://insights.sbomify.com/CVE-2023-51438/): Auth bypass in SIMATIC IPC1047E (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/168/