# Vulnerabilities published in 2023


- [CVE-2023-51331](https://insights.sbomify.com/CVE-2023-51331/): Code injection in phpjabbers:cleaning business software (medium 6.5)
- [CVE-2023-51330](https://insights.sbomify.com/CVE-2023-51330/): Cross-site scripting in phpjabbers:cinema booking system (medium 5.4)
- [CVE-2023-5133](https://insights.sbomify.com/CVE-2023-5133/): User Activity Log Pro < 2.3.4 - IP Spoofing (high 7.5)
- [CVE-2023-51328](https://insights.sbomify.com/CVE-2023-51328/): Cross-site scripting in phpjabbers:cleaning business software (medium 5.4)
- [CVE-2023-51327](https://insights.sbomify.com/CVE-2023-51327/): Denial of service in phpjabbers:cleaning business software (medium 6.5)
- [CVE-2023-51326](https://insights.sbomify.com/CVE-2023-51326/): Denial of service in phpjabbers:cleaning business software (medium 6.5)
- [CVE-2023-51325](https://insights.sbomify.com/CVE-2023-51325/): Cross-site scripting in phpjabbers:shared asset booking system (medium 5.4)
- [CVE-2023-51324](https://insights.sbomify.com/CVE-2023-51324/): Code injection in phpjabbers:shared asset booking system (medium 6.5)
- [CVE-2023-51323](https://insights.sbomify.com/CVE-2023-51323/): Denial of service in phpjabbers:shared asset booking system (medium 6.5)
- [CVE-2023-51321](https://insights.sbomify.com/CVE-2023-51321/): Denial of service in phpjabbers:night club booking software (medium 6.5)
- [CVE-2023-51320](https://insights.sbomify.com/CVE-2023-51320/): Code injection in phpjabbers:night club booking software (medium 5.3)
- [CVE-2023-5132](https://insights.sbomify.com/CVE-2023-5132/): Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure (high 7.5)
- [CVE-2023-51319](https://insights.sbomify.com/CVE-2023-51319/): Code injection in phpjabbers:bus reservation system (high 8.8)
- [CVE-2023-51318](https://insights.sbomify.com/CVE-2023-51318/): Cross-site scripting in phpjabbers:bus reservation system (medium 5.4)
- [CVE-2023-51317](https://insights.sbomify.com/CVE-2023-51317/): Cross-site scripting in phpjabbers:restaurant booking system (medium 6.5)
- [CVE-2023-51316](https://insights.sbomify.com/CVE-2023-51316/): Denial of service in phpjabbers:bus reservation system (high 7.5)
- [CVE-2023-51315](https://insights.sbomify.com/CVE-2023-51315/): Cross-site scripting in phpjabbers:restaurant booking system (medium 5.4)
- [CVE-2023-51314](https://insights.sbomify.com/CVE-2023-51314/): Denial of service in phpjabbers:restaurant booking system (high 7.5)
- [CVE-2023-51313](https://insights.sbomify.com/CVE-2023-51313/): Code injection in phpjabbers:restaurant booking system (high 8.8)
- [CVE-2023-51312](https://insights.sbomify.com/CVE-2023-51312/): Cross-site scripting in phpjabbers:restaurant booking system (medium 5.4)
- [CVE-2023-51311](https://insights.sbomify.com/CVE-2023-51311/): Code injection in phpjabbers:car park booking system (high 8.8)
- [CVE-2023-51310](https://insights.sbomify.com/CVE-2023-51310/): Denial of service in phpjabbers:car park booking system (medium 4.3)
- [CVE-2023-5131](https://insights.sbomify.com/CVE-2023-5131/): Delta Electronics ISPSoft Heap Buffer-Overflow (high 8.2)
- [CVE-2023-51309](https://insights.sbomify.com/CVE-2023-51309/): Denial of service in phpjabbers:car park booking system (medium 4.3)
- [CVE-2023-51308](https://insights.sbomify.com/CVE-2023-51308/): Cross-site scripting in phpjabbers:car park booking system (medium 6.1)
- [CVE-2023-51306](https://insights.sbomify.com/CVE-2023-51306/): Cross-site scripting in phpjabbers:event ticketing system (medium 5.4)
- [CVE-2023-51305](https://insights.sbomify.com/CVE-2023-51305/): PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin (medium 5.4)
- [CVE-2023-51303](https://insights.sbomify.com/CVE-2023-51303/): Cross-site scripting in phpjabbers:event ticketing system (medium 6.1)
- [CVE-2023-51302](https://insights.sbomify.com/CVE-2023-51302/): Code injection in phpjabbers:hotel booking system (high 8.8)
- [CVE-2023-51301](https://insights.sbomify.com/CVE-2023-51301/): Denial of service in phpjabbers:hotel booking system (high 7.5)
- [CVE-2023-51300](https://insights.sbomify.com/CVE-2023-51300/): Cross-site scripting in phpjabbers:hotel booking system (medium 6.1)
- [CVE-2023-5130](https://insights.sbomify.com/CVE-2023-5130/): Delta Electronics WPLSoft Buffer-Overflow (high 8.2)
- [CVE-2023-51299](https://insights.sbomify.com/CVE-2023-51299/): Cross-site scripting in phpjabbers:hotel booking system (medium 6.1)
- [CVE-2023-51298](https://insights.sbomify.com/CVE-2023-51298/): Code injection in phpjabbers:event booking calendar (medium 4.7)
- [CVE-2023-51297](https://insights.sbomify.com/CVE-2023-51297/): Denial of service in phpjabbers:hotel booking system (medium 6.5)
- [CVE-2023-51296](https://insights.sbomify.com/CVE-2023-51296/): Cross-site scripting in phpjabbers:event booking calendar (medium 6.1)
- [CVE-2023-51295](https://insights.sbomify.com/CVE-2023-51295/): Cross-site scripting in phpjabbers:event booking calendar (medium 6.5)
- [CVE-2023-51293](https://insights.sbomify.com/CVE-2023-51293/): Denial of service in phpjabbers:event booking calendar (high 7.5)
- [CVE-2023-51282](https://insights.sbomify.com/CVE-2023-51282/): Code injection in mingSoft MCMS (high 7.5)
- [CVE-2023-51281](https://insights.sbomify.com/CVE-2023-51281/): Cross-site scripting in oretnom23:customer support system (medium 5.4)
- [CVE-2023-5128](https://insights.sbomify.com/CVE-2023-5128/): TCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-51277](https://insights.sbomify.com/CVE-2023-51277/): Misconfiguration in tinowagner:jupyter notebook viewer (critical 9.8)
- [CVE-2023-5127](https://insights.sbomify.com/CVE-2023-5127/): WP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5126](https://insights.sbomify.com/CVE-2023-5126/): Delete Me <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 4.9)
- [CVE-2023-51258](https://insights.sbomify.com/CVE-2023-51258/): Denial of service in tortall:yasm (medium 5.5)
- [CVE-2023-51257](https://insights.sbomify.com/CVE-2023-51257/): Memory corruption in jasper project:jasper (high 7.8)
- [CVE-2023-51254](https://insights.sbomify.com/CVE-2023-51254/): Cross-site scripting in jfinalcms project:jfinalcms (medium 6.1)
- [CVE-2023-51252](https://insights.sbomify.com/CVE-2023-51252/): Cross-site scripting in publiccms:publiccms (medium 5.4)
- [CVE-2023-5125](https://insights.sbomify.com/CVE-2023-5125/): Contact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-51246](https://insights.sbomify.com/CVE-2023-51246/): Cross-site scripting in get-simple:getsimplecms (medium 5.4)
- [CVE-2023-5124](https://insights.sbomify.com/CVE-2023-5124/): PageLayer < 1.8.0 - Author+ Stored XSS (medium 4.8)
- [CVE-2023-51232](https://insights.sbomify.com/CVE-2023-51232/): Dagster vulnerable to Path Traversal attack through its /logs endpoint (high 7.5)
- [CVE-2023-5123](https://insights.sbomify.com/CVE-2023-5123/): Improper Path Sanitization in JSON Datasource Plugin (high 8.0)
- [CVE-2023-5122](https://insights.sbomify.com/CVE-2023-5122/): SSRF in CSV Datasource Plugin (medium 5.0)
- [CVE-2023-51219](https://insights.sbomify.com/CVE-2023-51219/): A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. (critical 9.6)
- [CVE-2023-51217](https://insights.sbomify.com/CVE-2023-51217/): Command injection in tenhot:tws-200 firmware (high 8.8)
- [CVE-2023-51210](https://insights.sbomify.com/CVE-2023-51210/): SQL injection in webkul:bundle product (critical 9.8)
- [CVE-2023-5121](https://insights.sbomify.com/CVE-2023-5121/): Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-5120](https://insights.sbomify.com/CVE-2023-5120/): Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-5119](https://insights.sbomify.com/CVE-2023-5119/): Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-5118](https://insights.sbomify.com/CVE-2023-5118/): Stored cross-site scripting vulnerability in Kofax Capture software (medium 5.4)
- [CVE-2023-5117](https://insights.sbomify.com/CVE-2023-5117/): Exposure of Sensitive Information Due to Incompatible Policies in GitLab (low 3.7)
- [CVE-2023-5116](https://insights.sbomify.com/CVE-2023-5116/): Live updates from Excel <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-51157](https://insights.sbomify.com/CVE-2023-51157/): Cross-site scripting in zkteco:wdms (medium 5.4)
- [CVE-2023-51154](https://insights.sbomify.com/CVE-2023-51154/): Path traversal in jizhicms:jizhicms (critical 9.8)
- [CVE-2023-5115](https://insights.sbomify.com/CVE-2023-5115/): Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files (medium 6.3)
- [CVE-2023-51148](https://insights.sbomify.com/CVE-2023-51148/): Memory corruption in trendnet:tew-821dap firmware (high 8.0)
- [CVE-2023-51147](https://insights.sbomify.com/CVE-2023-51147/): Memory corruption in trendnet:tew-821dap firmware (high 8.0)
- [CVE-2023-51146](https://insights.sbomify.com/CVE-2023-51146/): Memory corruption in trendnet:tew-821dap firmware (high 8.0)
- [CVE-2023-51142](https://insights.sbomify.com/CVE-2023-51142/): Information disclosure in zkteco:biotime (high 7.5)
- [CVE-2023-51141](https://insights.sbomify.com/CVE-2023-51141/): Information disclosure in zkteco:biotime (medium 6.5)
- [CVE-2023-5114](https://insights.sbomify.com/CVE-2023-5114/): idbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 5.4)
- [CVE-2023-51136](https://insights.sbomify.com/CVE-2023-51136/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-51135](https://insights.sbomify.com/CVE-2023-51135/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-51133](https://insights.sbomify.com/CVE-2023-51133/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-5113](https://insights.sbomify.com/CVE-2023-5113/): Cross-site scripting in Certain HP Enterprise LaserJet, LaserJet Managed printers (medium 6.1)
- [CVE-2023-51127](https://insights.sbomify.com/CVE-2023-51127/): Path traversal in flir:flir ax8 firmware (high 7.5)
- [CVE-2023-51126](https://insights.sbomify.com/CVE-2023-51126/): Command injection in flir:flir ax8 firmware (critical 9.8)
- [CVE-2023-51123](https://insights.sbomify.com/CVE-2023-51123/): Command injection in dlink:dir-815 firmware (critical 9.8)
- [CVE-2023-5112](https://insights.sbomify.com/CVE-2023-5112/): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (medium 5.4)
- [CVE-2023-5111](https://insights.sbomify.com/CVE-2023-5111/): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (medium 5.4)
- [CVE-2023-51107](https://insights.sbomify.com/CVE-2023-51107/): Denial of service in artifex:mupdf (high 7.5)
- [CVE-2023-51106](https://insights.sbomify.com/CVE-2023-51106/): Denial of service in artifex:mupdf (high 7.5)
- [CVE-2023-51105](https://insights.sbomify.com/CVE-2023-51105/): Denial of service in artifex:mupdf (high 7.5)
- [CVE-2023-51104](https://insights.sbomify.com/CVE-2023-51104/): Denial of service in artifex:mupdf (high 7.5)
- [CVE-2023-51103](https://insights.sbomify.com/CVE-2023-51103/): Denial of service in artifex:mupdf (high 7.5)
- [CVE-2023-51102](https://insights.sbomify.com/CVE-2023-51102/): Memory corruption in tenda:w9 firmware (critical 9.8)
- [CVE-2023-51101](https://insights.sbomify.com/CVE-2023-51101/): Memory corruption in tenda:w9 firmware (critical 9.8)
- [CVE-2023-51100](https://insights.sbomify.com/CVE-2023-51100/): Command injection in tenda:w9 firmware (critical 9.8)
- [CVE-2023-5110](https://insights.sbomify.com/CVE-2023-5110/): BSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-51099](https://insights.sbomify.com/CVE-2023-51099/): Command injection in tenda:w9 firmware (critical 9.8)
- [CVE-2023-51098](https://insights.sbomify.com/CVE-2023-51098/): Command injection in tenda:w9 firmware (critical 9.8)
- [CVE-2023-51097](https://insights.sbomify.com/CVE-2023-51097/): Memory corruption in tenda:w9 firmware (critical 9.8)
- [CVE-2023-51095](https://insights.sbomify.com/CVE-2023-51095/): Memory corruption in tenda:m3 firmware (critical 9.8)
- [CVE-2023-51094](https://insights.sbomify.com/CVE-2023-51094/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2023-51093](https://insights.sbomify.com/CVE-2023-51093/): Memory corruption in tenda:m3 firmware (critical 9.8)
- [CVE-2023-51092](https://insights.sbomify.com/CVE-2023-51092/): Memory corruption in tenda:m3 firmware (high 8.8)
- [CVE-2023-51091](https://insights.sbomify.com/CVE-2023-51091/): Memory corruption in tenda:m3 firmware (critical 9.8)
- [CVE-2023-51090](https://insights.sbomify.com/CVE-2023-51090/): Memory corruption in tenda:m3 firmware (critical 9.8)
- [CVE-2023-5109](https://insights.sbomify.com/CVE-2023-5109/): Cross-site scripting in WP Mailto Links – Protect Email Addresses (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/170/