# Vulnerabilities published in 2023


- [CVE-2023-49830](https://insights.sbomify.com/CVE-2023-49830/): WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE) (critical 9.9)
- [CVE-2023-4983](https://insights.sbomify.com/CVE-2023-4983/): app1pro Shopicial search cross site scripting (medium 4.3)
- [CVE-2023-49829](https://insights.sbomify.com/CVE-2023-49829/): WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49828](https://insights.sbomify.com/CVE-2023-49828/): WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49827](https://insights.sbomify.com/CVE-2023-49827/): WordPress Soledad Theme <= 8.4.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49826](https://insights.sbomify.com/CVE-2023-49826/): WordPress Soledad Theme <= 8.4.1 is vulnerable to PHP Object Injection (high 8.1)
- [CVE-2023-49825](https://insights.sbomify.com/CVE-2023-49825/): WordPress Soledad Theme <= 8.4.1 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-49824](https://insights.sbomify.com/CVE-2023-49824/): WordPress Product Catalog Feed by PixelYourSite Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49823](https://insights.sbomify.com/CVE-2023-49823/): WordPress Bold Page Builder Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49822](https://insights.sbomify.com/CVE-2023-49822/): WordPress Ultimate Dashboard plugin <= 3.7.10 - Secret Login Page Location Disclosure on Multisites vulnerability (low 3.7)
- [CVE-2023-49821](https://insights.sbomify.com/CVE-2023-49821/): WordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49820](https://insights.sbomify.com/CVE-2023-49820/): WordPress Structured Content Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4982](https://insights.sbomify.com/CVE-2023-4982/): Cross-site Scripting (XSS) - Stored in librenms/librenms (critical 9.8)
- [CVE-2023-49819](https://insights.sbomify.com/CVE-2023-49819/): WordPress Structured Content Plugin <= 1.5.3 is vulnerable to PHP Object Injection (high 7.5)
- [CVE-2023-49818](https://insights.sbomify.com/CVE-2023-49818/): WordPress Webflow Pages plugin <= 1.0.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-49817](https://insights.sbomify.com/CVE-2023-49817/): WordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerability (high 8.2)
- [CVE-2023-49816](https://insights.sbomify.com/CVE-2023-49816/): WordPress Fix My Feed RSS Repair Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49815](https://insights.sbomify.com/CVE-2023-49815/): WordPress WappPress plugin <= 5.0.3 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2023-49814](https://insights.sbomify.com/CVE-2023-49814/): WordPress Symbiostock Lite Plugin <= 6.0.0 is vulnerable to Arbitrary File Upload (critical 9.1)
- [CVE-2023-49813](https://insights.sbomify.com/CVE-2023-49813/): WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49812](https://insights.sbomify.com/CVE-2023-49812/): WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) (medium 5.3)
- [CVE-2023-49810](https://insights.sbomify.com/CVE-2023-49810/): WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability (high 7.3)
- [CVE-2023-4981](https://insights.sbomify.com/CVE-2023-4981/): Cross-site Scripting (XSS) - DOM in librenms/librenms (high 8.8)
- [CVE-2023-49809](https://insights.sbomify.com/CVE-2023-49809/): Todo plugin gets crashed and disabled by member (medium 4.3)
- [CVE-2023-49807](https://insights.sbomify.com/CVE-2023-49807/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-49805](https://insights.sbomify.com/CVE-2023-49805/): Uptime Kuma Missing Origin Validation in WebSockets (medium 6.0)
- [CVE-2023-49804](https://insights.sbomify.com/CVE-2023-49804/): Uptime Kuma Password Change Vulnerability (medium 6.7)
- [CVE-2023-49803](https://insights.sbomify.com/CVE-2023-49803/): @koa/cors has overly permissive origin policy (high 8.6)
- [CVE-2023-49802](https://insights.sbomify.com/CVE-2023-49802/): MantisBT LinkedCustomFields Cross-site Scripting vulnerability (medium 6.7)
- [CVE-2023-49801](https://insights.sbomify.com/CVE-2023-49801/): Lif Auth Server vulnerable to uncontrolled data in path expression (medium 4.2)
- [CVE-2023-49800](https://insights.sbomify.com/CVE-2023-49800/): Denial of service by abusing `fetchOptions.retry` in nuxt-api-party (high 7.5)
- [CVE-2023-4980](https://insights.sbomify.com/CVE-2023-4980/): Cross-site Scripting (XSS) - Generic in librenms/librenms (high 8.8)
- [CVE-2023-49799](https://insights.sbomify.com/CVE-2023-49799/): Server-Side Request Forgery in nuxt-api-party (high 7.5)
- [CVE-2023-49798](https://insights.sbomify.com/CVE-2023-49798/): Duplicated execution of subcalls in OpenZeppelin Contracts (medium 5.9)
- [CVE-2023-49797](https://insights.sbomify.com/CVE-2023-49797/): Local Privilege Escalation in pyinstaller on Windows (high 8.8)
- [CVE-2023-49796](https://insights.sbomify.com/CVE-2023-49796/): MindsDB Arbitrary File Write vulnerability (medium 5.3)
- [CVE-2023-49795](https://insights.sbomify.com/CVE-2023-49795/): MindsDB Server-Side Request Forgery vulnerability (medium 6.5)
- [CVE-2023-49794](https://insights.sbomify.com/CVE-2023-49794/): The logic of get apk path in KernelSU module can be bypassed (medium 6.7)
- [CVE-2023-49793](https://insights.sbomify.com/CVE-2023-49793/): Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store` (medium 6.5)
- [CVE-2023-49792](https://insights.sbomify.com/CVE-2023-49792/): Bruteforce protection can be bypassed with misconfigured proxy (medium 5.3)
- [CVE-2023-49791](https://insights.sbomify.com/CVE-2023-49791/): Workflows do not require password confirmation on API level (medium 5.4)
- [CVE-2023-49790](https://insights.sbomify.com/CVE-2023-49790/): App PIN code can be bypassed in Nextcloud Files iOS (medium 4.3)
- [CVE-2023-4979](https://insights.sbomify.com/CVE-2023-4979/): Cross-site Scripting (XSS) - Reflected in librenms/librenms (high 8.8)
- [CVE-2023-49788](https://insights.sbomify.com/CVE-2023-49788/): Improper handling of browser-side provided input in richdocuments path handling (high 7.2)
- [CVE-2023-49786](https://insights.sbomify.com/CVE-2023-49786/): Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation (high 7.5)
- [CVE-2023-49785](https://insights.sbomify.com/CVE-2023-49785/): NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting (critical 9.1)
- [CVE-2023-49783](https://insights.sbomify.com/CVE-2023-49783/): No permission checks for editing/deleting records with CSV import form (medium 4.3)
- [CVE-2023-49782](https://insights.sbomify.com/CVE-2023-49782/): Cross-Site-Scripting vulnerability in error message passing in richdocumentscode (high 7.1)
- [CVE-2023-49781](https://insights.sbomify.com/CVE-2023-49781/): NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue (high 7.3)
- [CVE-2023-49780](https://insights.sbomify.com/CVE-2023-49780/): Cross-site scripting in acmailer CGI (medium 6.1)
- [CVE-2023-4978](https://insights.sbomify.com/CVE-2023-4978/): Cross-site Scripting (XSS) - DOM in librenms/librenms (critical 9.0)
- [CVE-2023-49779](https://insights.sbomify.com/CVE-2023-49779/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-49778](https://insights.sbomify.com/CVE-2023-49778/): WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to PHP Object Injection (critical 10.0)
- [CVE-2023-49777](https://insights.sbomify.com/CVE-2023-49777/): WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection (critical 9.1)
- [CVE-2023-49776](https://insights.sbomify.com/CVE-2023-49776/): WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-49775](https://insights.sbomify.com/CVE-2023-49775/): WordPress CSV Importer Plugin <= 0.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49774](https://insights.sbomify.com/CVE-2023-49774/): WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability (medium 5.3)
- [CVE-2023-49773](https://insights.sbomify.com/CVE-2023-49773/): WordPress BCorp Shortcodes Plugin <= 0.23 is vulnerable to PHP Object Injection (critical 10.0)
- [CVE-2023-49772](https://insights.sbomify.com/CVE-2023-49772/): WordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object Injection (critical 10.0)
- [CVE-2023-49771](https://insights.sbomify.com/CVE-2023-49771/): WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49770](https://insights.sbomify.com/CVE-2023-49770/): WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4977](https://insights.sbomify.com/CVE-2023-4977/): Code Injection in librenms/librenms (high 7.3)
- [CVE-2023-49769](https://insights.sbomify.com/CVE-2023-49769/): WordPress Integrate Google Drive Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49768](https://insights.sbomify.com/CVE-2023-49768/): WordPress WP-FormAssembly plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2023-49767](https://insights.sbomify.com/CVE-2023-49767/): WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49766](https://insights.sbomify.com/CVE-2023-49766/): WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49765](https://insights.sbomify.com/CVE-2023-49765/): WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR) (medium 4.3)
- [CVE-2023-49764](https://insights.sbomify.com/CVE-2023-49764/): WordPress Advanced Database Cleaner Plugin <= 3.1.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-49763](https://insights.sbomify.com/CVE-2023-49763/): WordPress CSprite Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49762](https://insights.sbomify.com/CVE-2023-49762/): WordPress AppMySite Plugin <= 3.11.0 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-49761](https://insights.sbomify.com/CVE-2023-49761/): WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49760](https://insights.sbomify.com/CVE-2023-49760/): WordPress WPsoonOnlinePage Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-4976](https://insights.sbomify.com/CVE-2023-4976/): FlashBlade Authentication Mechanism Vulnerability (critical 9.3)
- [CVE-2023-49759](https://insights.sbomify.com/CVE-2023-49759/): WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49758](https://insights.sbomify.com/CVE-2023-49758/): WordPress WP Booking System plugin <= 2.0.19.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49757](https://insights.sbomify.com/CVE-2023-49757/): WordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerability (medium 5.4)
- [CVE-2023-49756](https://insights.sbomify.com/CVE-2023-49756/): WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability (medium 5.4)
- [CVE-2023-49755](https://insights.sbomify.com/CVE-2023-49755/): WordPress Elementor Timeline Widget plugin <= 2.2 - Notice Dismissal Vulnerability (medium 5.4)
- [CVE-2023-49754](https://insights.sbomify.com/CVE-2023-49754/): WordPress Bulk Edit Post Titles plugin <= 5.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49753](https://insights.sbomify.com/CVE-2023-49753/): WordPress Adifier System plugin < 3.1.4 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2023-49752](https://insights.sbomify.com/CVE-2023-49752/): WordPress Adifier System Plugin < 3.1.4 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-49751](https://insights.sbomify.com/CVE-2023-49751/): WordPress Block for Font Awesome Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49750](https://insights.sbomify.com/CVE-2023-49750/): WordPress Couponis Demo Plugin < 2.2 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-4975](https://insights.sbomify.com/CVE-2023-4975/): Website Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2023-49749](https://insights.sbomify.com/CVE-2023-49749/): WordPress SureTriggers Plugin <= 1.0.23 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49748](https://insights.sbomify.com/CVE-2023-49748/): WordPress WPS Hide Login plugin <= 1.9.11 - Secret Login Page Location Disclosure on Multisites vulnerability (low 3.7)
- [CVE-2023-49747](https://insights.sbomify.com/CVE-2023-49747/): WordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49746](https://insights.sbomify.com/CVE-2023-49746/): WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.9)
- [CVE-2023-49745](https://insights.sbomify.com/CVE-2023-49745/): WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49744](https://insights.sbomify.com/CVE-2023-49744/): Cross-site request forgery in Gift Up Gift Cards for WordPress and WooCommerce (medium 5.4)
- [CVE-2023-49743](https://insights.sbomify.com/CVE-2023-49743/): WordPress Dashboard Widgets Suite Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49742](https://insights.sbomify.com/CVE-2023-49742/): WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2023-49741](https://insights.sbomify.com/CVE-2023-49741/): WordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerability (low 3.7)
- [CVE-2023-49740](https://insights.sbomify.com/CVE-2023-49740/): WordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4974](https://insights.sbomify.com/CVE-2023-4974/): Academy LMS GET Parameter filter sql injection (medium 6.3)
- [CVE-2023-49739](https://insights.sbomify.com/CVE-2023-49739/): WordPress PowerPack Pro for Elementor plugin <= 2.9.23 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-49738](https://insights.sbomify.com/CVE-2023-49738/): Path traversal in AVideo (high 7.5)
- [CVE-2023-49736](https://insights.sbomify.com/CVE-2023-49736/): Apache Superset: SQL Injection on where_in JINJA macro (medium 6.5)
- [CVE-2023-49735](https://insights.sbomify.com/CVE-2023-49735/): Apache Tiles: Unvalidated input may lead to path traversal and XXE (high 7.5)
- [CVE-2023-49734](https://insights.sbomify.com/CVE-2023-49734/): Apache Superset: Privilege Escalation Vulnerability (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/179/