# Vulnerabilities published in 2023 - [CVE-2023-48803](https://insights.sbomify.com/CVE-2023-48803/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48802](https://insights.sbomify.com/CVE-2023-48802/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48801](https://insights.sbomify.com/CVE-2023-48801/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48800](https://insights.sbomify.com/CVE-2023-48800/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48799](https://insights.sbomify.com/CVE-2023-48799/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2023-48796](https://insights.sbomify.com/CVE-2023-48796/): Apache dolphinscheduler sensitive information disclosure (high 7.5) - [CVE-2023-48795](https://insights.sbomify.com/CVE-2023-48795/): Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin (medium 5.9) - [CVE-2023-48793](https://insights.sbomify.com/CVE-2023-48793/): SQL injection in zohocorp:manageengine adaudit plus (critical 9.8) - [CVE-2023-48792](https://insights.sbomify.com/CVE-2023-48792/): SQL injection in zohocorp:manageengine adaudit plus (critical 9.8) - [CVE-2023-48791](https://insights.sbomify.com/CVE-2023-48791/): Command injection in FortiPortal (high 7.9) - [CVE-2023-48790](https://insights.sbomify.com/CVE-2023-48790/): Cross-site request forgery in FortiNDR (high 7.1) - [CVE-2023-4879](https://insights.sbomify.com/CVE-2023-4879/): Cross-site Scripting (XSS) - Stored in instantsoft/icms2 (low 3.5) - [CVE-2023-48789](https://insights.sbomify.com/CVE-2023-48789/): Security feature bypass in FortiPortal (medium 4.1) - [CVE-2023-48788](https://insights.sbomify.com/CVE-2023-48788/): Fortinet FortiClient EMS SQL Injection (critical 9.3, exploited in the wild) - [CVE-2023-48786](https://insights.sbomify.com/CVE-2023-48786/): Server-side request forgery in FortiClientEMS (medium 4.1) - [CVE-2023-48785](https://insights.sbomify.com/CVE-2023-48785/): Security feature bypass in FortiNAC-F (medium 4.4) - [CVE-2023-48784](https://insights.sbomify.com/CVE-2023-48784/): Memory corruption in FortiOS (medium 6.1) - [CVE-2023-48783](https://insights.sbomify.com/CVE-2023-48783/): Missing authorization in FortiPortal (medium 4.9) - [CVE-2023-48782](https://insights.sbomify.com/CVE-2023-48782/): Command injection in FortiWLM (high 8.6) - [CVE-2023-48781](https://insights.sbomify.com/CVE-2023-48781/): Cross-site request forgery in MkRapel Regiones y Ciudades de Chile para WC (medium 4.3) - [CVE-2023-48780](https://insights.sbomify.com/CVE-2023-48780/): WordPress WP Catalogue Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-4878](https://insights.sbomify.com/CVE-2023-4878/): Server-Side Request Forgery (SSRF) in instantsoft/icms2 (medium 4.3) - [CVE-2023-48779](https://insights.sbomify.com/CVE-2023-48779/): WordPress 360 Javascript Viewer plugin <= 1.7.11 - Broken Access Control vulnerability (medium 6.5) - [CVE-2023-48778](https://insights.sbomify.com/CVE-2023-48778/): WordPress Product Size Chart For WooCommerce Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-48777](https://insights.sbomify.com/CVE-2023-48777/): WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability (critical 9.9) - [CVE-2023-48776](https://insights.sbomify.com/CVE-2023-48776/): WordPress canvasio3D Light plugin <= 2.5.0 - Broken Access Control vulnerability (medium 5.4) - [CVE-2023-48775](https://insights.sbomify.com/CVE-2023-48775/): WordPress WP CleanFix plugin <= 5.6.2 - Broken Access Control vulnerability (medium 5.3) - [CVE-2023-48774](https://insights.sbomify.com/CVE-2023-48774/): WordPress IdeaPush plugin < 8.58 - Broken Access Control vulnerability (medium 5.4) - [CVE-2023-48773](https://insights.sbomify.com/CVE-2023-48773/): WordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-48772](https://insights.sbomify.com/CVE-2023-48772/): WordPress Prevent Landscape Rotation Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-48771](https://insights.sbomify.com/CVE-2023-48771/): WordPress File Gallery Plugin <= 1.8.5.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-48770](https://insights.sbomify.com/CVE-2023-48770/): WordPress Aparat Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-4877](https://insights.sbomify.com/CVE-2023-4877/): Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure (medium 5.5) - [CVE-2023-48769](https://insights.sbomify.com/CVE-2023-48769/): WordPress Chat Bubble Plugin <= 2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-48768](https://insights.sbomify.com/CVE-2023-48768/): Cross-site request forgery in Quantity Plus Minus Button for WooCommerce by CodeAstrology (medium 4.3) - [CVE-2023-48767](https://insights.sbomify.com/CVE-2023-48767/): WordPress MyTube PlayList Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-48766](https://insights.sbomify.com/CVE-2023-48766/): WordPress SVGator – Add Animated SVG Easily Plugin <= 1.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-48765](https://insights.sbomify.com/CVE-2023-48765/): WordPress Email Address Encoder Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-48764](https://insights.sbomify.com/CVE-2023-48764/): WordPress WordPress Brute Force Protection – Stop Brute Force Attacks Plugin <= 2.2.5 is vulnerable to SQL Injection (high 7.6) - [CVE-2023-48763](https://insights.sbomify.com/CVE-2023-48763/): WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability (medium 5.3) - [CVE-2023-48762](https://insights.sbomify.com/CVE-2023-48762/): WordPress JetElements For Elementor Plugin <= 2.6.13 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.3) - [CVE-2023-48761](https://insights.sbomify.com/CVE-2023-48761/): WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability (medium 6.3) - [CVE-2023-48760](https://insights.sbomify.com/CVE-2023-48760/): WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability (high 8.2) - [CVE-2023-4876](https://insights.sbomify.com/CVE-2023-4876/): Exposure of Sensitive Information to an Unauthorized Actor in hamza417/inure (high 7.9) - [CVE-2023-48759](https://insights.sbomify.com/CVE-2023-48759/): WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability (high 7.5) - [CVE-2023-48758](https://insights.sbomify.com/CVE-2023-48758/): WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability (high 7.1) - [CVE-2023-48757](https://insights.sbomify.com/CVE-2023-48757/): WordPress JetEngine plugin <= 3.2.4 - Privilege Escalation vulnerability (high 8.8) - [CVE-2023-48756](https://insights.sbomify.com/CVE-2023-48756/): WordPress JetBlocks For Elementor Plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-48755](https://insights.sbomify.com/CVE-2023-48755/): WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-48754](https://insights.sbomify.com/CVE-2023-48754/): WordPress Delete Post Revisions In WordPress Plugin <= 4.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-48753](https://insights.sbomify.com/CVE-2023-48753/): WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability (medium 5.3) - [CVE-2023-48752](https://insights.sbomify.com/CVE-2023-48752/): WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-48751](https://insights.sbomify.com/CVE-2023-48751/): WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control (medium 4.3) - [CVE-2023-48750](https://insights.sbomify.com/CVE-2023-48750/): Missing authorization in Void Elementor Post Grid Addon for Elementor Page builder (medium 5.3) - [CVE-2023-4875](https://insights.sbomify.com/CVE-2023-4875/): Undefined Behavior for Input to API in Mutt (low 2.2) - [CVE-2023-48749](https://insights.sbomify.com/CVE-2023-48749/): WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-48748](https://insights.sbomify.com/CVE-2023-48748/): WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-48747](https://insights.sbomify.com/CVE-2023-48747/): WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification Vulnerability (medium 6.5) - [CVE-2023-48746](https://insights.sbomify.com/CVE-2023-48746/): WordPress Community by PeepSo Plugin <= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-48745](https://insights.sbomify.com/CVE-2023-48745/): WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability (medium 5.3) - [CVE-2023-48744](https://insights.sbomify.com/CVE-2023-48744/): WordPress Availability Calendar Plugin <= 1.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-48743](https://insights.sbomify.com/CVE-2023-48743/): WordPress Simply Exclude Plugin <= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.8) - [CVE-2023-48742](https://insights.sbomify.com/CVE-2023-48742/): WordPress License Manager for WooCommerce Plugin <= 2.2.10 is vulnerable to SQL Injection (high 7.6) - [CVE-2023-48741](https://insights.sbomify.com/CVE-2023-48741/): WordPress ChatBot Plugin <= 4.7.8 is vulnerable to SQL Injection (high 7.6) - [CVE-2023-48740](https://insights.sbomify.com/CVE-2023-48740/): WordPress Easy Social Feed plugin <= 6.5.1 - Broken Access Control vulnerability (medium 4.3) - [CVE-2023-4874](https://insights.sbomify.com/CVE-2023-4874/): Undefined Behavior for Input to API in Mutt (medium 4.3) - [CVE-2023-48739](https://insights.sbomify.com/CVE-2023-48739/): WordPress Porto Theme Functionality plugin < 2.12.1 - Broken Access Control vulnerability (medium 5.3) - [CVE-2023-48738](https://insights.sbomify.com/CVE-2023-48738/): WordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to SQL Injection (critical 9.3) - [CVE-2023-48737](https://insights.sbomify.com/CVE-2023-48737/): WordPress TriPay Payment Gateway Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-48736](https://insights.sbomify.com/CVE-2023-48736/): Memory corruption in color:demoiccmax (medium 6.5) - [CVE-2023-48733](https://insights.sbomify.com/CVE-2023-48733/): Misconfiguration in Ubuntu EDK II (medium 6.7) - [CVE-2023-48732](https://insights.sbomify.com/CVE-2023-48732/): Keywords that trigger mentions are leaked to other users (medium 4.3) - [CVE-2023-48730](https://insights.sbomify.com/CVE-2023-48730/): Cross-site scripting in AVideo (high 8.5) - [CVE-2023-4873](https://insights.sbomify.com/CVE-2023-4873/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php os command injection (medium 6.3) - [CVE-2023-48728](https://insights.sbomify.com/CVE-2023-48728/): Cross-site scripting in AVideo (critical 9.6) - [CVE-2023-48727](https://insights.sbomify.com/CVE-2023-48727/): Null dereference in Intel(R) oneVPL software (low 3.3) - [CVE-2023-48725](https://insights.sbomify.com/CVE-2023-48725/): Memory corruption in RAX30 (high 7.2) - [CVE-2023-48724](https://insights.sbomify.com/CVE-2023-48724/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.5) - [CVE-2023-48722](https://insights.sbomify.com/CVE-2023-48722/): Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-48720](https://insights.sbomify.com/CVE-2023-48720/): Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-4872](https://insights.sbomify.com/CVE-2023-4872/): SourceCodester Contact Manager App add.php sql injection (medium 6.3) - [CVE-2023-48718](https://insights.sbomify.com/CVE-2023-48718/): Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-48716](https://insights.sbomify.com/CVE-2023-48716/): Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-48715](https://insights.sbomify.com/CVE-2023-48715/): Tuleap vulnerable to Cross-site Scripting on the edition page of a release (medium 5.4) - [CVE-2023-48714](https://insights.sbomify.com/CVE-2023-48714/): Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter (medium 4.3) - [CVE-2023-48713](https://insights.sbomify.com/CVE-2023-48713/): Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler (medium 6.5) - [CVE-2023-48712](https://insights.sbomify.com/CVE-2023-48712/): User authorization bug leading to privilege escalation in warpgate (high 7.1) - [CVE-2023-48711](https://insights.sbomify.com/CVE-2023-48711/): Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browser (low 3.7) - [CVE-2023-48710](https://insights.sbomify.com/CVE-2023-48710/): iTop limit pages/exec.php script to PHP files (critical 9.8) - [CVE-2023-4871](https://insights.sbomify.com/CVE-2023-4871/): SourceCodester Contact Manager App delete.php sql injection (medium 6.3) - [CVE-2023-48709](https://insights.sbomify.com/CVE-2023-48709/): iTop vulnerable to potential formula injection in Excel/CSV export file (high 8.0) - [CVE-2023-48708](https://insights.sbomify.com/CVE-2023-48708/): Insertion of Sensitive Information into Log in codeigniter4/shield (medium 5.0) - [CVE-2023-48707](https://insights.sbomify.com/CVE-2023-48707/): Cleartext Storage of Sensitive Information in codeigniter4/shield (medium 5.0) - [CVE-2023-48706](https://insights.sbomify.com/CVE-2023-48706/): Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite (low 3.6) - [CVE-2023-48705](https://insights.sbomify.com/CVE-2023-48705/): nautobot has XSS potential in custom links, job buttons, and computed fields (high 7.1) - [CVE-2023-48704](https://insights.sbomify.com/CVE-2023-48704/): Unauthenticated heap buffer overflow in Gorrila codec decompression (high 7.0) - [CVE-2023-48703](https://insights.sbomify.com/CVE-2023-48703/): SAML authentication bypass vulnerability in RobotsAndPencils/go-saml (high 7.5) - [CVE-2023-48702](https://insights.sbomify.com/CVE-2023-48702/): Jellyfin Possible Remote Code Execution via custom FFmpeg binary (high 7.2) - [CVE-2023-48701](https://insights.sbomify.com/CVE-2023-48701/): Statamic CMS vulnerable to Cross-site Scripting via uploaded assets (high 7.5) - [CVE-2023-48700](https://insights.sbomify.com/CVE-2023-48700/): Clear Text Credentials Exposed via Onboarding Task (medium 5.7) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/186/