# Vulnerabilities published in 2023


- [CVE-2023-47573](https://insights.sbomify.com/CVE-2023-47573/): Missing authorization in relyum:rely-pcie firmware (high 8.8)
- [CVE-2023-4757](https://insights.sbomify.com/CVE-2023-4757/): Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries (medium 5.4)
- [CVE-2023-47568](https://insights.sbomify.com/CVE-2023-47568/): QTS, QuTS hero, QuTScloud (high 8.8)
- [CVE-2023-47567](https://insights.sbomify.com/CVE-2023-47567/): QTS, QuTS hero, QuTScloud (medium 4.7)
- [CVE-2023-47566](https://insights.sbomify.com/CVE-2023-47566/): QTS, QuTS hero, QuTScloud (medium 6.7)
- [CVE-2023-47565](https://insights.sbomify.com/CVE-2023-47565/): QNAP VioStor NVR OS Command Injection (high 8.0, exploited in the wild)
- [CVE-2023-47564](https://insights.sbomify.com/CVE-2023-47564/): Qsync Central (high 8.0)
- [CVE-2023-47563](https://insights.sbomify.com/CVE-2023-47563/): Video Station (high 7.4)
- [CVE-2023-47562](https://insights.sbomify.com/CVE-2023-47562/): Photo Station (high 7.4)
- [CVE-2023-47561](https://insights.sbomify.com/CVE-2023-47561/): Photo Station (medium 5.5)
- [CVE-2023-47560](https://insights.sbomify.com/CVE-2023-47560/): QuMagie (high 7.4)
- [CVE-2023-4756](https://insights.sbomify.com/CVE-2023-4756/): Stack-based Buffer Overflow in gpac/gpac (medium 5.9)
- [CVE-2023-47559](https://insights.sbomify.com/CVE-2023-47559/): QuMagie (medium 5.5)
- [CVE-2023-47558](https://insights.sbomify.com/CVE-2023-47558/): WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-47557](https://insights.sbomify.com/CVE-2023-47557/): WordPress Visitor Traffic Real Time Statistics plugin <= 7.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47556](https://insights.sbomify.com/CVE-2023-47556/): WordPress Device Theme Switcher Plugin <= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47554](https://insights.sbomify.com/CVE-2023-47554/): Cross-site scripting in Actueel Financieel Nieuws – Denk Internet Solutions (medium 5.9)
- [CVE-2023-47553](https://insights.sbomify.com/CVE-2023-47553/): WordPress UserHeat Plugin Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47552](https://insights.sbomify.com/CVE-2023-47552/): WordPress Image Hover Effects Plugin <= 5.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47551](https://insights.sbomify.com/CVE-2023-47551/): WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47550](https://insights.sbomify.com/CVE-2023-47550/): WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4755](https://insights.sbomify.com/CVE-2023-4755/): Use After Free in gpac/gpac (medium 5.3)
- [CVE-2023-47549](https://insights.sbomify.com/CVE-2023-47549/): WordPress EazyDocs Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.8)
- [CVE-2023-47548](https://insights.sbomify.com/CVE-2023-47548/): WordPress Integrate Google Drive Plugin <= 1.3.2 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-47547](https://insights.sbomify.com/CVE-2023-47547/): Cross-site scripting in Products, Order & Customers Export for WooCommerce (high 7.1)
- [CVE-2023-47546](https://insights.sbomify.com/CVE-2023-47546/): WordPress OneClick Chat to Order Plugin <= 1.0.4.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47545](https://insights.sbomify.com/CVE-2023-47545/): WordPress Forms for Mailchimp by Optin Cat Plugin <= 2.5.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47544](https://insights.sbomify.com/CVE-2023-47544/): WordPress Atarim Plugin <= 3.12 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47543](https://insights.sbomify.com/CVE-2023-47543/): Missing authorization in FortiPortal (medium 5.1)
- [CVE-2023-47542](https://insights.sbomify.com/CVE-2023-47542/): Code injection in FortiManager (medium 6.3)
- [CVE-2023-47541](https://insights.sbomify.com/CVE-2023-47541/): Path traversal in FortiSandbox (medium 6.5)
- [CVE-2023-47540](https://insights.sbomify.com/CVE-2023-47540/): Command injection in FortiSandbox (medium 6.5)
- [CVE-2023-4754](https://insights.sbomify.com/CVE-2023-4754/): Out-of-bounds Write in gpac/gpac (medium 5.3)
- [CVE-2023-47539](https://insights.sbomify.com/CVE-2023-47539/): Auth bypass in FortiMail (critical 9.0)
- [CVE-2023-47537](https://insights.sbomify.com/CVE-2023-47537/): Security feature bypass in FortiOS (medium 4.4)
- [CVE-2023-47536](https://insights.sbomify.com/CVE-2023-47536/): Security feature bypass in FortiOS (low 2.8)
- [CVE-2023-47534](https://insights.sbomify.com/CVE-2023-47534/): Code injection in FortiClientEMS (high 8.7)
- [CVE-2023-47533](https://insights.sbomify.com/CVE-2023-47533/): WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47532](https://insights.sbomify.com/CVE-2023-47532/): WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-47531](https://insights.sbomify.com/CVE-2023-47531/): WordPress Droit Dark Mode Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47530](https://insights.sbomify.com/CVE-2023-47530/): WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-4753](https://insights.sbomify.com/CVE-2023-4753/): OpenHarmony v3.2.1 and prior version has a system call function usage error (low 3.9)
- [CVE-2023-47529](https://insights.sbomify.com/CVE-2023-47529/): WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-47528](https://insights.sbomify.com/CVE-2023-47528/): WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47527](https://insights.sbomify.com/CVE-2023-47527/): WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47526](https://insights.sbomify.com/CVE-2023-47526/): WordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47525](https://insights.sbomify.com/CVE-2023-47525/): WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47524](https://insights.sbomify.com/CVE-2023-47524/): WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-47523](https://insights.sbomify.com/CVE-2023-47523/): WordPress Auto Tag Creator plugin <= 1.0.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47522](https://insights.sbomify.com/CVE-2023-47522/): WordPress Photo Feed Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47521](https://insights.sbomify.com/CVE-2023-47521/): WordPress Q2W3 Post Order Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47520](https://insights.sbomify.com/CVE-2023-47520/): WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4752](https://insights.sbomify.com/CVE-2023-4752/): Use After Free in vim/vim (high 7.8)
- [CVE-2023-47519](https://insights.sbomify.com/CVE-2023-47519/): WordPress WooCommerce Product Table Lite Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47518](https://insights.sbomify.com/CVE-2023-47518/): WordPress Restrict Categories Plugin <= 2.6.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47517](https://insights.sbomify.com/CVE-2023-47517/): WordPress SendPress Newsletters Plugin <= 1.23.11.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47516](https://insights.sbomify.com/CVE-2023-47516/): WordPress Category Post List Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47515](https://insights.sbomify.com/CVE-2023-47515/): WordPress Seers | GDPR & CCPA Cookie Consent & Compliance plugin <= 8.1.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47514](https://insights.sbomify.com/CVE-2023-47514/): WordPress Star CloudPRNT for WooCommerce Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47513](https://insights.sbomify.com/CVE-2023-47513/): WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection vulnerability (medium 5.4)
- [CVE-2023-47512](https://insights.sbomify.com/CVE-2023-47512/): WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47511](https://insights.sbomify.com/CVE-2023-47511/): WordPress Pinyin Slugs Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47510](https://insights.sbomify.com/CVE-2023-47510/): Cross-site scripting in WPDBSpringClean (high 7.1)
- [CVE-2023-4751](https://insights.sbomify.com/CVE-2023-4751/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2023-47509](https://insights.sbomify.com/CVE-2023-47509/): WordPress Edit WooCommerce Templates Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47508](https://insights.sbomify.com/CVE-2023-47508/): WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47507](https://insights.sbomify.com/CVE-2023-47507/): WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to PHP Object Injection (high 7.1)
- [CVE-2023-47506](https://insights.sbomify.com/CVE-2023-47506/): WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-47505](https://insights.sbomify.com/CVE-2023-47505/): WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47504](https://insights.sbomify.com/CVE-2023-47504/): WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability (medium 6.5)
- [CVE-2023-47503](https://insights.sbomify.com/CVE-2023-47503/): Code injection in jflyfox:jfinal cms (critical 9.8)
- [CVE-2023-4750](https://insights.sbomify.com/CVE-2023-4750/): Use After Free in vim/vim (high 7.8)
- [CVE-2023-4749](https://insights.sbomify.com/CVE-2023-4749/): SourceCodester Inventory Management System index.php file inclusion (medium 6.3)
- [CVE-2023-47489](https://insights.sbomify.com/CVE-2023-47489/): Code injection in combodo:itop (high 7.8)
- [CVE-2023-47488](https://insights.sbomify.com/CVE-2023-47488/): Cross-site scripting in combodo:itop (medium 6.1)
- [CVE-2023-47480](https://insights.sbomify.com/CVE-2023-47480/): An issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function. (high 8.4)
- [CVE-2023-4748](https://insights.sbomify.com/CVE-2023-4748/): Yongyou UFIDA-NC PrintTemplateFileServlet.java path traversal (medium 6.3)
- [CVE-2023-47473](https://insights.sbomify.com/CVE-2023-47473/): Path traversal in fuwushe:ifair (high 7.5)
- [CVE-2023-47471](https://insights.sbomify.com/CVE-2023-47471/): Memory corruption in struktur:libde265 (medium 6.5)
- [CVE-2023-47470](https://insights.sbomify.com/CVE-2023-47470/): Memory corruption in ffmpeg:ffmpeg (high 7.8)
- [CVE-2023-4747](https://insights.sbomify.com/CVE-2023-4747/): DedeCMS tags.php sql injection (medium 6.3)
- [CVE-2023-47467](https://insights.sbomify.com/CVE-2023-47467/): Directory Traversal in jeecg-boot (medium 6.5)
- [CVE-2023-47466](https://insights.sbomify.com/CVE-2023-47466/): Null dereference in TagLib (low 2.9)
- [CVE-2023-47465](https://insights.sbomify.com/CVE-2023-47465/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2023-47464](https://insights.sbomify.com/CVE-2023-47464/): Path traversal in gl-inet:gl-ax1800 firmware (high 8.8)
- [CVE-2023-47463](https://insights.sbomify.com/CVE-2023-47463/): Code injection in gl-inet:gl-ax1800 firmware (critical 9.8)
- [CVE-2023-47462](https://insights.sbomify.com/CVE-2023-47462/): Misconfiguration in gl-inet:gl-ax1800 firmware (critical 9.8)
- [CVE-2023-47460](https://insights.sbomify.com/CVE-2023-47460/): SQL injection in knovos:discovery (high 8.8)
- [CVE-2023-4746](https://insights.sbomify.com/CVE-2023-4746/): TOTOLINK N200RE V5 Validity_check format string (high 8.8)
- [CVE-2023-47459](https://insights.sbomify.com/CVE-2023-47459/): Information disclosure in knovos:discovery (medium 6.5)
- [CVE-2023-47458](https://insights.sbomify.com/CVE-2023-47458/): Missing authorization in bladex:springblade (critical 9.8)
- [CVE-2023-47456](https://insights.sbomify.com/CVE-2023-47456/): Memory corruption in tenda:ax1806 firmware (critical 9.1)
- [CVE-2023-47455](https://insights.sbomify.com/CVE-2023-47455/): Memory corruption in tenda:ax1806 firmware (critical 9.1)
- [CVE-2023-47454](https://insights.sbomify.com/CVE-2023-47454/): Privilege escalation in netease:cloudmusic (high 7.8)
- [CVE-2023-47453](https://insights.sbomify.com/CVE-2023-47453/): Privilege escalation in sohu:video player (high 7.8)
- [CVE-2023-47452](https://insights.sbomify.com/CVE-2023-47452/): Other in notepad-plus-plus:notepad\+\+ (high 7.8)
- [CVE-2023-4745](https://insights.sbomify.com/CVE-2023-4745/): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php sql injection (medium 6.3)
- [CVE-2023-47446](https://insights.sbomify.com/CVE-2023-47446/): Cross-site scripting in phpgurukul:pre-school enrollment system (medium 5.4)
- [CVE-2023-47445](https://insights.sbomify.com/CVE-2023-47445/): SQL injection in phpgurukul:pre-school enrollment system (critical 9.8)
- [CVE-2023-47444](https://insights.sbomify.com/CVE-2023-47444/): Code injection in opencart:opencart (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/196/