Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 179 of 430.
- CVE-2023-49830 WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE)
- CVE-2023-4983 app1pro Shopicial search cross site scripting
- CVE-2023-49829 WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49828 WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49827 WordPress Soledad Theme <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49826 WordPress Soledad Theme <= 8.4.1 is vulnerable to PHP Object Injection
- CVE-2023-49825 WordPress Soledad Theme <= 8.4.1 is vulnerable to SQL Injection
- CVE-2023-49824 WordPress Product Catalog Feed by PixelYourSite Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49823 WordPress Bold Page Builder Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49822 WordPress Ultimate Dashboard plugin <= 3.7.10 - Secret Login Page Location Disclosure on Multisites vulnerability
- CVE-2023-49821 WordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49820 WordPress Structured Content Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms
- CVE-2023-49819 WordPress Structured Content Plugin <= 1.5.3 is vulnerable to PHP Object Injection
- CVE-2023-49818 WordPress Webflow Pages plugin <= 1.0.8 - Broken Access Control vulnerability
- CVE-2023-49817 WordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerability
- CVE-2023-49816 WordPress Fix My Feed RSS Repair Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49815 WordPress WappPress plugin <= 5.0.3 - Unauthenticated Arbitrary File Upload vulnerability
- CVE-2023-49814 WordPress Symbiostock Lite Plugin <= 6.0.0 is vulnerable to Arbitrary File Upload
- CVE-2023-49813 WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49812 WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-49810 WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability
- CVE-2023-4981 Cross-site Scripting (XSS) - DOM in librenms/librenms
- CVE-2023-49809 Todo plugin gets crashed and disabled by member
- CVE-2023-49807 Cross-site scripting in GROWI
- CVE-2023-49805 Uptime Kuma Missing Origin Validation in WebSockets
- CVE-2023-49804 Uptime Kuma Password Change Vulnerability
- CVE-2023-49803 @koa/cors has overly permissive origin policy
- CVE-2023-49802 MantisBT LinkedCustomFields Cross-site Scripting vulnerability
- CVE-2023-49801 Lif Auth Server vulnerable to uncontrolled data in path expression
- CVE-2023-49800 Denial of service by abusing `fetchOptions.retry` in nuxt-api-party
- CVE-2023-4980 Cross-site Scripting (XSS) - Generic in librenms/librenms
- CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party
- CVE-2023-49798 Duplicated execution of subcalls in OpenZeppelin Contracts
- CVE-2023-49797 Local Privilege Escalation in pyinstaller on Windows
- CVE-2023-49796 MindsDB Arbitrary File Write vulnerability
- CVE-2023-49795 MindsDB Server-Side Request Forgery vulnerability
- CVE-2023-49794 The logic of get apk path in KernelSU module can be bypassed
- CVE-2023-49793 Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`
- CVE-2023-49792 Bruteforce protection can be bypassed with misconfigured proxy
- CVE-2023-49791 Workflows do not require password confirmation on API level
- CVE-2023-49790 App PIN code can be bypassed in Nextcloud Files iOS
- CVE-2023-4979 Cross-site Scripting (XSS) - Reflected in librenms/librenms
- CVE-2023-49788 Improper handling of browser-side provided input in richdocuments path handling
- CVE-2023-49786 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
- CVE-2023-49785 NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting
- CVE-2023-49783 No permission checks for editing/deleting records with CSV import form
- CVE-2023-49782 Cross-Site-Scripting vulnerability in error message passing in richdocumentscode
- CVE-2023-49781 NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue
- CVE-2023-49780 Cross-site scripting in acmailer CGI
- CVE-2023-4978 Cross-site Scripting (XSS) - DOM in librenms/librenms
- CVE-2023-49779 Cross-site scripting in GROWI
- CVE-2023-49778 WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to PHP Object Injection
- CVE-2023-49777 WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection
- CVE-2023-49776 WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL Injection
- CVE-2023-49775 WordPress CSV Importer Plugin <= 0.3.8 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49774 WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability
- CVE-2023-49773 WordPress BCorp Shortcodes Plugin <= 0.23 is vulnerable to PHP Object Injection
- CVE-2023-49772 WordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object Injection
- CVE-2023-49771 WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49770 WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-4977 Code Injection in librenms/librenms
- CVE-2023-49769 WordPress Integrate Google Drive Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49768 WordPress WP-FormAssembly plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2023-49767 WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49766 WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49765 WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-49764 WordPress Advanced Database Cleaner Plugin <= 3.1.2 is vulnerable to SQL Injection
- CVE-2023-49763 WordPress CSprite Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49762 WordPress AppMySite Plugin <= 3.11.0 is vulnerable to Sensitive Data Exposure
- CVE-2023-49761 WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49760 WordPress WPsoonOnlinePage Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-4976 FlashBlade Authentication Mechanism Vulnerability
- CVE-2023-49759 WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49758 WordPress WP Booking System plugin <= 2.0.19.2 - Broken Access Control vulnerability
- CVE-2023-49757 WordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerability
- CVE-2023-49756 WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability
- CVE-2023-49755 WordPress Elementor Timeline Widget plugin <= 2.2 - Notice Dismissal Vulnerability
- CVE-2023-49754 WordPress Bulk Edit Post Titles plugin <= 5.0.0 - Broken Access Control vulnerability
- CVE-2023-49753 WordPress Adifier System plugin < 3.1.4 - Local File Inclusion vulnerability
- CVE-2023-49752 WordPress Adifier System Plugin < 3.1.4 is vulnerable to SQL Injection
- CVE-2023-49751 WordPress Block for Font Awesome Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49750 WordPress Couponis Demo Plugin < 2.2 is vulnerable to SQL Injection
- CVE-2023-4975 Website Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings Update
- CVE-2023-49749 WordPress SureTriggers Plugin <= 1.0.23 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-49748 WordPress WPS Hide Login plugin <= 1.9.11 - Secret Login Page Location Disclosure on Multisites vulnerability
- CVE-2023-49747 WordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49746 WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF)
- CVE-2023-49745 WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49744 Cross-site request forgery in Gift Up Gift Cards for WordPress and WooCommerce
- CVE-2023-49743 WordPress Dashboard Widgets Suite Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49742 WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability
- CVE-2023-49741 WordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerability
- CVE-2023-49740 WordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-4974 Academy LMS GET Parameter filter sql injection
- CVE-2023-49739 WordPress PowerPack Pro for Elementor plugin <= 2.9.23 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-49738 Path traversal in AVideo
- CVE-2023-49736 Apache Superset: SQL Injection on where_in JINJA macro
- CVE-2023-49735 Apache Tiles: Unvalidated input may lead to path traversal and XXE
- CVE-2023-49734 Apache Superset: Privilege Escalation Vulnerability