# Vulnerabilities published in 2023


- [CVE-2023-5016](https://insights.sbomify.com/CVE-2023-5016/): spider-flow API DataSourceController.java DriverManager.getConnection deserialization (medium 6.3)
- [CVE-2023-50159](https://insights.sbomify.com/CVE-2023-50159/): Security feature bypass in scalefusion:scalefusion (high 8.8)
- [CVE-2023-5015](https://insights.sbomify.com/CVE-2023-5015/): UCMS cross site scripting (low 3.5)
- [CVE-2023-50147](https://insights.sbomify.com/CVE-2023-50147/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-5014](https://insights.sbomify.com/CVE-2023-5014/): Sakshi2610 Food Ordering Website categoryfood.php sql injection (medium 6.3)
- [CVE-2023-50137](https://insights.sbomify.com/CVE-2023-50137/): Cross-site Scripting in JFinalcms (medium 5.4)
- [CVE-2023-50136](https://insights.sbomify.com/CVE-2023-50136/): Cross-site scripting in jfinalcms project:jfinalcms (medium 5.4)
- [CVE-2023-5013](https://insights.sbomify.com/CVE-2023-5013/): Pluck CMS Installation install.php cross site scripting (low 2.6)
- [CVE-2023-50129](https://insights.sbomify.com/CVE-2023-50129/): Weak cryptography in flient:smart lock advanced firmware (medium 6.5)
- [CVE-2023-50128](https://insights.sbomify.com/CVE-2023-50128/): Auth bypass in hozard:alarm system (medium 5.3)
- [CVE-2023-50127](https://insights.sbomify.com/CVE-2023-50127/): Auth bypass in hozard:alarm system (medium 5.9)
- [CVE-2023-50126](https://insights.sbomify.com/CVE-2023-50126/): Weak cryptography in hozard:alarm system (medium 6.5)
- [CVE-2023-50125](https://insights.sbomify.com/CVE-2023-50125/): Hardcoded credentials in hozard:alarm system (medium 5.9)
- [CVE-2023-50124](https://insights.sbomify.com/CVE-2023-50124/): Hardcoded credentials in flient:smart lock advanced firmware (medium 6.8)
- [CVE-2023-50123](https://insights.sbomify.com/CVE-2023-50123/): Auth bypass in hozard:alarm system (high 8.1)
- [CVE-2023-50121](https://insights.sbomify.com/CVE-2023-50121/): Denial of service in autelrobotics:evo nano drone firmware (medium 5.7)
- [CVE-2023-50120](https://insights.sbomify.com/CVE-2023-50120/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2023-5012](https://insights.sbomify.com/CVE-2023-5012/): Topaz OFD Protection Module Warsaw core.exe unquoted search path (medium 5.3)
- [CVE-2023-50110](https://insights.sbomify.com/CVE-2023-50110/): Auth bypass in testlink:testlink (high 7.5)
- [CVE-2023-5011](https://insights.sbomify.com/CVE-2023-5011/): Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8)
- [CVE-2023-50104](https://insights.sbomify.com/CVE-2023-50104/): File upload in zzcms:zzcms (critical 9.8)
- [CVE-2023-50102](https://insights.sbomify.com/CVE-2023-50102/): Cross-site Scripting in JFinalcms (medium 5.4)
- [CVE-2023-50101](https://insights.sbomify.com/CVE-2023-50101/): Cross-site Scripting in JFinalcms (medium 5.4)
- [CVE-2023-50100](https://insights.sbomify.com/CVE-2023-50100/): Cross-site Scripting in JFinalcms (medium 5.4)
- [CVE-2023-5010](https://insights.sbomify.com/CVE-2023-5010/): Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8)
- [CVE-2023-50096](https://insights.sbomify.com/CVE-2023-50096/): Memory corruption in st:x-cube-safea1 (high 7.5)
- [CVE-2023-50094](https://insights.sbomify.com/CVE-2023-50094/): Command injection in yogeshojha:rengine (high 8.8)
- [CVE-2023-50093](https://insights.sbomify.com/CVE-2023-50093/): Other in apiida:api gateway manager (medium 5.4)
- [CVE-2023-50092](https://insights.sbomify.com/CVE-2023-50092/): Cross-site scripting in apiida:api gateway manager (medium 6.1)
- [CVE-2023-50090](https://insights.sbomify.com/CVE-2023-50090/): Path traversal in ureport2 project:ureport2 (critical 9.8)
- [CVE-2023-5009](https://insights.sbomify.com/CVE-2023-5009/): Incorrect Authorization in GitLab (high 8.2)
- [CVE-2023-50089](https://insights.sbomify.com/CVE-2023-50089/): Command injection in netgear:wnr2000 firmware (critical 9.8)
- [CVE-2023-50082](https://insights.sbomify.com/CVE-2023-50082/): Auth bypass in pbootcms:pbootcms (high 7.5)
- [CVE-2023-5008](https://insights.sbomify.com/CVE-2023-5008/): Student Information System v1.0 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2023-50073](https://insights.sbomify.com/CVE-2023-50073/): SQL injection in leadscloud:empirecms (critical 9.8)
- [CVE-2023-50072](https://insights.sbomify.com/CVE-2023-50072/): Cross-site scripting in openkm:openkm (medium 5.4)
- [CVE-2023-50071](https://insights.sbomify.com/CVE-2023-50071/): SQL injection in customer support system project:customer support system (high 8.8)
- [CVE-2023-50070](https://insights.sbomify.com/CVE-2023-50070/): SQL injection in oretnom23:customer support system (high 8.8)
- [CVE-2023-5007](https://insights.sbomify.com/CVE-2023-5007/): Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8)
- [CVE-2023-50069](https://insights.sbomify.com/CVE-2023-50069/): Cross-site scripting in wiremock:wiremock (medium 6.1)
- [CVE-2023-50061](https://insights.sbomify.com/CVE-2023-50061/): SQL injection in store-opart:op\'art easy redirect (critical 9.8)
- [CVE-2023-5006](https://insights.sbomify.com/CVE-2023-5006/): WP Discord Invite < 2.5.1 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2023-50059](https://insights.sbomify.com/CVE-2023-50059/): An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galx (medium 5.3)
- [CVE-2023-50053](https://insights.sbomify.com/CVE-2023-50053/): An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication proc (high 7.6)
- [CVE-2023-5005](https://insights.sbomify.com/CVE-2023-5005/): Autocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site Scripting (medium 4.8)
- [CVE-2023-50044](https://insights.sbomify.com/CVE-2023-50044/): Memory corruption in cesanta:mjs (critical 9.8)
- [CVE-2023-5004](https://insights.sbomify.com/CVE-2023-5004/): Hospital-management-system-in-php 378c157 - Blind SQL Injection (critical 9.8)
- [CVE-2023-50038](https://insights.sbomify.com/CVE-2023-50038/): File upload in textpattern:textpattern (high 8.8)
- [CVE-2023-50035](https://insights.sbomify.com/CVE-2023-50035/): SQL injection in small crm project:small crm (critical 9.8)
- [CVE-2023-50030](https://insights.sbomify.com/CVE-2023-50030/): SQL injection in joommasters:jmssetting (critical 9.8)
- [CVE-2023-5003](https://insights.sbomify.com/CVE-2023-5003/): Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure (high 7.5)
- [CVE-2023-50029](https://insights.sbomify.com/CVE-2023-50029/): PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers (critical 10.0)
- [CVE-2023-50028](https://insights.sbomify.com/CVE-2023-50028/): SQL injection in prestashopmodules:sliding cart block (critical 9.8)
- [CVE-2023-50027](https://insights.sbomify.com/CVE-2023-50027/): SQL injection in buy-addons:bazoom magnifier (critical 9.8)
- [CVE-2023-50026](https://insights.sbomify.com/CVE-2023-50026/): SQL injection in prestamonster:multi accessories pro (critical 9.8)
- [CVE-2023-50020](https://insights.sbomify.com/CVE-2023-50020/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2023-5002](https://insights.sbomify.com/CVE-2023-5002/): Pgadmin4: remote code execution by an authenticated user (medium 6.0)
- [CVE-2023-50019](https://insights.sbomify.com/CVE-2023-50019/): Denial of service in open5gs:open5gs (medium 5.9)
- [CVE-2023-50017](https://insights.sbomify.com/CVE-2023-50017/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-50015](https://insights.sbomify.com/CVE-2023-50015/): An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect ac (high 8.8)
- [CVE-2023-50011](https://insights.sbomify.com/CVE-2023-50011/): Command injection in popojicms:popojicms (high 7.2)
- [CVE-2023-50010](https://insights.sbomify.com/CVE-2023-50010/): Memory corruption in fedoraproject:fedora (high 7.8)
- [CVE-2023-5001](https://insights.sbomify.com/CVE-2023-5001/): Horizontal scrolling announcement <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-50009](https://insights.sbomify.com/CVE-2023-50009/): Memory corruption in fedoraproject:fedora (high 8.0)
- [CVE-2023-50008](https://insights.sbomify.com/CVE-2023-50008/): Denial of service in fedoraproject:fedora (high 7.8)
- [CVE-2023-50007](https://insights.sbomify.com/CVE-2023-50007/): Memory corruption in fedoraproject:fedora (medium 4.0)
- [CVE-2023-50002](https://insights.sbomify.com/CVE-2023-50002/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-50001](https://insights.sbomify.com/CVE-2023-50001/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-50000](https://insights.sbomify.com/CVE-2023-50000/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-5000](https://insights.sbomify.com/CVE-2023-5000/): Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-49999](https://insights.sbomify.com/CVE-2023-49999/): Command injection in tenda:w30e firmware (critical 9.8)
- [CVE-2023-49994](https://insights.sbomify.com/CVE-2023-49994/): Denial of service in espeak-ng:espeak-ng (medium 5.5)
- [CVE-2023-49993](https://insights.sbomify.com/CVE-2023-49993/): Memory corruption in espeak-ng:espeak-ng (medium 5.3)
- [CVE-2023-49992](https://insights.sbomify.com/CVE-2023-49992/): Memory corruption in espeak-ng:espeak-ng (medium 5.3)
- [CVE-2023-49991](https://insights.sbomify.com/CVE-2023-49991/): Memory corruption in espeak-ng:espeak-ng (medium 5.3)
- [CVE-2023-49990](https://insights.sbomify.com/CVE-2023-49990/): Memory corruption in espeak-ng:espeak-ng (medium 5.3)
- [CVE-2023-4999](https://insights.sbomify.com/CVE-2023-4999/): Horizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-49989](https://insights.sbomify.com/CVE-2023-49989/): SQL injection in pratham-jaiswal:hotel booking management system (critical 9.8)
- [CVE-2023-49988](https://insights.sbomify.com/CVE-2023-49988/): SQL injection in pratham-jaiswal:hotel booking management system (high 7.5)
- [CVE-2023-49987](https://insights.sbomify.com/CVE-2023-49987/): Cross-site scripting in oretnom23:school fees management system (medium 5.4)
- [CVE-2023-49986](https://insights.sbomify.com/CVE-2023-49986/): Cross-site scripting in oretnom23:school fees management system (medium 4.7)
- [CVE-2023-49985](https://insights.sbomify.com/CVE-2023-49985/): Cross-site scripting in oretnom23:school fees management system (medium 6.5)
- [CVE-2023-49984](https://insights.sbomify.com/CVE-2023-49984/): Cross-site scripting in oretnom23:school fees management system (medium 6.1)
- [CVE-2023-49983](https://insights.sbomify.com/CVE-2023-49983/): Cross-site scripting in oretnom23:school fees management system (medium 6.8)
- [CVE-2023-49982](https://insights.sbomify.com/CVE-2023-49982/): Missing authorization in oretnom23:school fees management system (high 8.8)
- [CVE-2023-49981](https://insights.sbomify.com/CVE-2023-49981/): Information disclosure in oretnom23:school fees management system (high 7.5)
- [CVE-2023-49980](https://insights.sbomify.com/CVE-2023-49980/): Information disclosure in mayurik:best student result management system (high 7.5)
- [CVE-2023-49979](https://insights.sbomify.com/CVE-2023-49979/): Information disclosure in mayurik:best student management system (high 7.5)
- [CVE-2023-49978](https://insights.sbomify.com/CVE-2023-49978/): Missing authorization in oretnom23:customer support system (high 7.2)
- [CVE-2023-49977](https://insights.sbomify.com/CVE-2023-49977/): Cross-site scripting in oretnom23:customer support system (medium 5.4)
- [CVE-2023-49976](https://insights.sbomify.com/CVE-2023-49976/): Cross-site scripting in oretnom23:customer support system (medium 5.4)
- [CVE-2023-49974](https://insights.sbomify.com/CVE-2023-49974/): Cross-site scripting in oretnom23:customer support system (medium 6.1)
- [CVE-2023-49973](https://insights.sbomify.com/CVE-2023-49973/): Cross-site scripting in oretnom23:customer support system (medium 6.1)
- [CVE-2023-49971](https://insights.sbomify.com/CVE-2023-49971/): Cross-site scripting in oretnom23:customer support system (medium 4.7)
- [CVE-2023-49970](https://insights.sbomify.com/CVE-2023-49970/): SQL injection in oretnom23:customer support system (critical 9.8)
- [CVE-2023-4997](https://insights.sbomify.com/CVE-2023-4997/): Improper authorisation in Uptime DC (high 8.8)
- [CVE-2023-49969](https://insights.sbomify.com/CVE-2023-49969/): SQL injection in oretnom23:customer support system (medium 4.3)
- [CVE-2023-49968](https://insights.sbomify.com/CVE-2023-49968/): SQL injection in oretnom23:customer support system (high 7.3)
- [CVE-2023-49967](https://insights.sbomify.com/CVE-2023-49967/): Denial of service in typecho:typecho (high 7.5)
- [CVE-2023-49965](https://insights.sbomify.com/CVE-2023-49965/): SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page. (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/177/