# Vulnerabilities published in 2023 - [CVE-2023-49001](https://insights.sbomify.com/CVE-2023-49001/): Code injection in indibrowser:indi browser (critical 9.8) - [CVE-2023-49000](https://insights.sbomify.com/CVE-2023-49000/): Security feature bypass in artistscope:artisbrowser (critical 9.8) - [CVE-2023-4900](https://insights.sbomify.com/CVE-2023-4900/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-4899](https://insights.sbomify.com/CVE-2023-4899/): SQL Injection in mintplex-labs/anything-llm (high 8.1) - [CVE-2023-48987](https://insights.sbomify.com/CVE-2023-48987/): SQL injection in cusg:content management system (high 7.5) - [CVE-2023-48986](https://insights.sbomify.com/CVE-2023-48986/): Cross-site scripting in cusg:content management system (medium 6.1) - [CVE-2023-48985](https://insights.sbomify.com/CVE-2023-48985/): Cross-site scripting in cusg:content management system (medium 6.1) - [CVE-2023-4898](https://insights.sbomify.com/CVE-2023-4898/): Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm (high 8.2) - [CVE-2023-48978](https://insights.sbomify.com/CVE-2023-48978/): Code injection in ncr:itm web terminal (critical 9.8) - [CVE-2023-48974](https://insights.sbomify.com/CVE-2023-48974/): Cross-site scripting in axigen:axigen mail server (critical 9.6) - [CVE-2023-4897](https://insights.sbomify.com/CVE-2023-4897/): Relative Path Traversal in mintplex-labs/anything-llm (high 8.7) - [CVE-2023-48967](https://insights.sbomify.com/CVE-2023-48967/): Solon is vulnerable to Deserialization of Untrusted Data (critical 9.8) - [CVE-2023-48966](https://insights.sbomify.com/CVE-2023-48966/): ThinkAdmin arbitrary file upload vulnerability (high 8.8) - [CVE-2023-48965](https://insights.sbomify.com/CVE-2023-48965/): File upload in thinkadmin:thinkadmin (high 8.8) - [CVE-2023-48964](https://insights.sbomify.com/CVE-2023-48964/): Memory corruption in tenda:i6 firmware (high 7.5) - [CVE-2023-48963](https://insights.sbomify.com/CVE-2023-48963/): Memory corruption in tenda:i6 firmware (high 7.5) - [CVE-2023-4896](https://insights.sbomify.com/CVE-2023-4896/): Authenticated Disclosure of Sensitive Information in AirWave Management Platform (medium 6.8) - [CVE-2023-48958](https://insights.sbomify.com/CVE-2023-48958/): Denial of service in gpac:gpac (medium 5.5) - [CVE-2023-48957](https://insights.sbomify.com/CVE-2023-48957/): Information disclosure in purevpn:purevpn (medium 5.3) - [CVE-2023-48952](https://insights.sbomify.com/CVE-2023-48952/): Denial of service in openlinksw:virtuoso (high 7.5) - [CVE-2023-48951](https://insights.sbomify.com/CVE-2023-48951/): Denial of service in openlinksw:virtuoso (high 8.8) - [CVE-2023-48950](https://insights.sbomify.com/CVE-2023-48950/): Denial of service in openlinksw:virtuoso (high 7.5) - [CVE-2023-4895](https://insights.sbomify.com/CVE-2023-4895/): Missing Authorization in GitLab (medium 4.3) - [CVE-2023-48949](https://insights.sbomify.com/CVE-2023-48949/): Denial of service in openlinksw:virtuoso (high 7.5) - [CVE-2023-48948](https://insights.sbomify.com/CVE-2023-48948/): Denial of service in openlinksw:virtuoso (high 7.5) - [CVE-2023-48947](https://insights.sbomify.com/CVE-2023-48947/): Denial of service in openlinksw:virtuoso (high 7.5) - [CVE-2023-48946](https://insights.sbomify.com/CVE-2023-48946/): Denial of service in openlinksw:virtuoso (high 7.5) - [CVE-2023-48945](https://insights.sbomify.com/CVE-2023-48945/): Memory corruption in openlinksw:virtuoso (high 7.5) - [CVE-2023-48940](https://insights.sbomify.com/CVE-2023-48940/): Cross-site scripting in daicuo:daicuo (medium 5.4) - [CVE-2023-48930](https://insights.sbomify.com/CVE-2023-48930/): File upload in rockoa:xinhu (critical 9.8) - [CVE-2023-4893](https://insights.sbomify.com/CVE-2023-4893/): Crayon Syntax Highlighter <= 2.8.4 - Authenticated (Contributor+) Server Side Request Forgery (medium 6.4) - [CVE-2023-48929](https://insights.sbomify.com/CVE-2023-48929/): Auth bypass in franklin-electric:system sentinel anyware (critical 9.8) - [CVE-2023-48928](https://insights.sbomify.com/CVE-2023-48928/): Open redirect in franklin-electric:system sentinel anyware (medium 6.1) - [CVE-2023-48926](https://insights.sbomify.com/CVE-2023-48926/): Missing authorization in prestashop:advanced loyalty program (medium 5.3) - [CVE-2023-48925](https://insights.sbomify.com/CVE-2023-48925/): SQL injection in buy-addons:bavideotab (critical 9.8) - [CVE-2023-4892](https://insights.sbomify.com/CVE-2023-4892/): Teedy v1.11 - Stored cross-site scripting (XSS) (medium 5.7) - [CVE-2023-48914](https://insights.sbomify.com/CVE-2023-48914/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8) - [CVE-2023-48913](https://insights.sbomify.com/CVE-2023-48913/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8) - [CVE-2023-48912](https://insights.sbomify.com/CVE-2023-48912/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8) - [CVE-2023-48910](https://insights.sbomify.com/CVE-2023-48910/): Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download (critical 9.8) - [CVE-2023-4891](https://insights.sbomify.com/CVE-2023-4891/): Use after free in Lenovo View Driver (medium 5.5) - [CVE-2023-48909](https://insights.sbomify.com/CVE-2023-48909/): Code injection in aarboard:jave2 (high 8.8) - [CVE-2023-48906](https://insights.sbomify.com/CVE-2023-48906/): Stack Overflow vulnerability in Btstack 1.6 and earlier allows attackers to cause a denial of service via crafted input to the char_for_nibble function. (medium 4.3) - [CVE-2023-48903](https://insights.sbomify.com/CVE-2023-48903/): Cross-site scripting in tramyardg:autoexpress (medium 6.1) - [CVE-2023-48902](https://insights.sbomify.com/CVE-2023-48902/): Auth bypass in tramyardg:autoexpress (critical 9.8) - [CVE-2023-48901](https://insights.sbomify.com/CVE-2023-48901/): SQL injection in tramyardg:autoexpress (critical 9.8) - [CVE-2023-4890](https://insights.sbomify.com/CVE-2023-4890/): JQuery Accordion Menu Widget <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4) - [CVE-2023-48894](https://insights.sbomify.com/CVE-2023-48894/): Missing authorization in huaxiaerp:jsherp (medium 6.5) - [CVE-2023-48893](https://insights.sbomify.com/CVE-2023-48893/): SQL injection in slims:senayan library management system bulian (high 8.8) - [CVE-2023-4889](https://insights.sbomify.com/CVE-2023-4889/): Shareaholic <= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4) - [CVE-2023-48887](https://insights.sbomify.com/CVE-2023-48887/): Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request (critical 9.8) - [CVE-2023-48886](https://insights.sbomify.com/CVE-2023-48886/): Deserialization in luxiaoxun:nettyrpc (critical 9.8) - [CVE-2023-48882](https://insights.sbomify.com/CVE-2023-48882/): Cross-site scripting in eyoucms:eyoucms (medium 4.8) - [CVE-2023-48881](https://insights.sbomify.com/CVE-2023-48881/): Cross-site scripting in eyoucms:eyoucms (medium 4.8) - [CVE-2023-48880](https://insights.sbomify.com/CVE-2023-48880/): Cross-site scripting in eyoucms:eyoucms (medium 4.8) - [CVE-2023-4888](https://insights.sbomify.com/CVE-2023-4888/): Simple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4) - [CVE-2023-4887](https://insights.sbomify.com/CVE-2023-4887/): Google Maps Plugin by Intergeo <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4) - [CVE-2023-48866](https://insights.sbomify.com/CVE-2023-48866/): Cross-site scripting in grocy project:grocy (medium 5.4) - [CVE-2023-48865](https://insights.sbomify.com/CVE-2023-48865/): Reportico affected by Incorrect Access Control (medium 6.5) - [CVE-2023-48864](https://insights.sbomify.com/CVE-2023-48864/): SQL injection in sem-cms:semcms (high 7.5) - [CVE-2023-48863](https://insights.sbomify.com/CVE-2023-48863/): SQL injection in sem-cms:semcms (high 7.5) - [CVE-2023-48861](https://insights.sbomify.com/CVE-2023-48861/): Privilege escalation in baidu:ttplayer (high 7.8) - [CVE-2023-48860](https://insights.sbomify.com/CVE-2023-48860/): Missing authorization in totolink:n300rt firmware (critical 9.8) - [CVE-2023-4886](https://insights.sbomify.com/CVE-2023-4886/): Foreman: world readable file containing secrets (medium 6.7) - [CVE-2023-48859](https://insights.sbomify.com/CVE-2023-48859/): Missing authorization in totolink:a3002ru firmware (high 8.8) - [CVE-2023-48858](https://insights.sbomify.com/CVE-2023-48858/): Cross-site scripting in abocms:abo.cms (medium 6.1) - [CVE-2023-4885](https://insights.sbomify.com/CVE-2023-4885/): Multiple vulnerabilities in Open5GS (medium 6.5) - [CVE-2023-48849](https://insights.sbomify.com/CVE-2023-48849/): Code injection in ruijie:rg-eg1000c firmware (critical 9.8) - [CVE-2023-48848](https://insights.sbomify.com/CVE-2023-48848/): ureport arbitrary file read vulnerability (high 7.5) - [CVE-2023-48842](https://insights.sbomify.com/CVE-2023-48842/): Command injection in dlink:go-rt-ac750 firmware (critical 9.8) - [CVE-2023-48841](https://insights.sbomify.com/CVE-2023-48841/): Code injection in phpjabbers:appointment scheduler (high 8.8) - [CVE-2023-48840](https://insights.sbomify.com/CVE-2023-48840/): Denial of service in phpjabbers:appointment scheduler (high 7.5) - [CVE-2023-4884](https://insights.sbomify.com/CVE-2023-4884/): Multiple vulnerabilities in Open5GS (medium 6.5) - [CVE-2023-48839](https://insights.sbomify.com/CVE-2023-48839/): Cross-site scripting in phpjabbers:appointment scheduler (medium 5.4) - [CVE-2023-48838](https://insights.sbomify.com/CVE-2023-48838/): Cross-site scripting in phpjabbers:appointment scheduler (medium 5.4) - [CVE-2023-48837](https://insights.sbomify.com/CVE-2023-48837/): Cross-site scripting in phpjabbers:car rental script (medium 5.4) - [CVE-2023-48836](https://insights.sbomify.com/CVE-2023-48836/): Cross-site scripting in phpjabbers:car rental script (medium 5.4) - [CVE-2023-48835](https://insights.sbomify.com/CVE-2023-48835/): Code injection in phpjabbers:car rental script (high 8.8) - [CVE-2023-48834](https://insights.sbomify.com/CVE-2023-48834/): Denial of service in phpjabbers:car rental script (high 7.5) - [CVE-2023-48833](https://insights.sbomify.com/CVE-2023-48833/): Denial of service in phpjabbers:time slots booking calendar (high 7.5) - [CVE-2023-48831](https://insights.sbomify.com/CVE-2023-48831/): Denial of service in phpjabbers:availability booking calendar (high 7.5) - [CVE-2023-48830](https://insights.sbomify.com/CVE-2023-48830/): Code injection in phpjabbers:shuttle booking software (high 8.8) - [CVE-2023-4883](https://insights.sbomify.com/CVE-2023-4883/): Multiple vulnerabilities in Open5GS (high 7.5) - [CVE-2023-48828](https://insights.sbomify.com/CVE-2023-48828/): Cross-site scripting in phpjabbers:time slots booking calendar (medium 5.4) - [CVE-2023-48827](https://insights.sbomify.com/CVE-2023-48827/): Cross-site scripting in phpjabbers:time slots booking calendar (medium 5.4) - [CVE-2023-48826](https://insights.sbomify.com/CVE-2023-48826/): Code injection in phpjabbers:time slots booking calendar (high 8.8) - [CVE-2023-48825](https://insights.sbomify.com/CVE-2023-48825/): Cross-site scripting in phpjabbers:availability booking calendar (medium 5.4) - [CVE-2023-48824](https://insights.sbomify.com/CVE-2023-48824/): Cross-site scripting in boidcms:boidcms (medium 5.4) - [CVE-2023-48823](https://insights.sbomify.com/CVE-2023-48823/): SQL injection in mayurik:courier management system (critical 9.8) - [CVE-2023-4882](https://insights.sbomify.com/CVE-2023-4882/): Multiple vulnerabilities in Open5GS (high 7.5) - [CVE-2023-48815](https://insights.sbomify.com/CVE-2023-48815/): Open redirect in keking:kkfileview (medium 6.1) - [CVE-2023-48813](https://insights.sbomify.com/CVE-2023-48813/): SQL injection in slims:senayan library management system bulian (high 8.8) - [CVE-2023-48812](https://insights.sbomify.com/CVE-2023-48812/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48811](https://insights.sbomify.com/CVE-2023-48811/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48810](https://insights.sbomify.com/CVE-2023-48810/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48808](https://insights.sbomify.com/CVE-2023-48808/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48807](https://insights.sbomify.com/CVE-2023-48807/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48806](https://insights.sbomify.com/CVE-2023-48806/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48805](https://insights.sbomify.com/CVE-2023-48805/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48804](https://insights.sbomify.com/CVE-2023-48804/): Command injection in totolink:x6000r firmware (critical 9.8) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/185/