# Vulnerabilities published in 2023


- [CVE-2023-46625](https://insights.sbomify.com/CVE-2023-46625/): WordPress Autolinks Manager Plugin <= 1.10.04 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46624](https://insights.sbomify.com/CVE-2023-46624/): WordPress Parcel Pro Plugin <= 1.6.11 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-46623](https://insights.sbomify.com/CVE-2023-46623/): WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE) (critical 9.9)
- [CVE-2023-46622](https://insights.sbomify.com/CVE-2023-46622/): WordPress WPPizza Plugin <= 3.18.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46621](https://insights.sbomify.com/CVE-2023-46621/): WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46620](https://insights.sbomify.com/CVE-2023-46620/): WordPress DeepL Pro API translation Plugin <= 2.3.9.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4662](https://insights.sbomify.com/CVE-2023-4662/): RCE in Saphira Connect (critical 9.8)
- [CVE-2023-46619](https://insights.sbomify.com/CVE-2023-46619/): WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-46618](https://insights.sbomify.com/CVE-2023-46618/): WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46617](https://insights.sbomify.com/CVE-2023-46617/): Cross-site request forgery in AdFoxly – Ad Manager, AdSense Ads & Ads.txt (medium 5.4)
- [CVE-2023-46616](https://insights.sbomify.com/CVE-2023-46616/): WordPress Draw Attention plugin <= 2.0.15 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-46615](https://insights.sbomify.com/CVE-2023-46615/): WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection (medium 5.4)
- [CVE-2023-46614](https://insights.sbomify.com/CVE-2023-46614/): WordPress WP Helper Premium Plugin <= 4.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-46613](https://insights.sbomify.com/CVE-2023-46613/): WordPress Add to Calendar Button Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-46612](https://insights.sbomify.com/CVE-2023-46612/): WordPress Mediabay plugin <= 1.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-46611](https://insights.sbomify.com/CVE-2023-46611/): WordPress YOP Poll plugin <= 6.5.28 - Vote Manipulation Due to Broken Captcha Control Vulnerability (medium 5.3)
- [CVE-2023-46610](https://insights.sbomify.com/CVE-2023-46610/): WordPress Quill Forms plugin <= 3.3.0 - Broken Access Control + CSRF vulnerability (medium 6.5)
- [CVE-2023-4661](https://insights.sbomify.com/CVE-2023-4661/): SQLi in Saphira Connect (critical 9.8)
- [CVE-2023-46609](https://insights.sbomify.com/CVE-2023-46609/): WordPress FeedFocal plugin <= 1.2.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-46608](https://insights.sbomify.com/CVE-2023-46608/): WordPress DoLogin Security plugin <= 3.7.1 - Multiple Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46607](https://insights.sbomify.com/CVE-2023-46607/): WordPress WP iCal Availability plugin <= 1.0.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-46606](https://insights.sbomify.com/CVE-2023-46606/): WordPress AtomChat plugin <= 1.1.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46605](https://insights.sbomify.com/CVE-2023-46605/): WordPress Convertful – Your Ultimate On-Site Conversion Tool plugin <= 2.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46604](https://insights.sbomify.com/CVE-2023-46604/): Apache ActiveMQ Deserialization of Untrusted Data (critical 10.0, exploited in the wild)
- [CVE-2023-46603](https://insights.sbomify.com/CVE-2023-46603/): Memory corruption in color:demoiccmax (high 8.8)
- [CVE-2023-46602](https://insights.sbomify.com/CVE-2023-46602/): Memory corruption in color:demoiccmax (high 8.8)
- [CVE-2023-46601](https://insights.sbomify.com/CVE-2023-46601/): Missing authorization in COMOS (critical 9.6)
- [CVE-2023-46596](https://insights.sbomify.com/CVE-2023-46596/): Improper input validation in FireFlow’s VisualFlow workflow editor (medium 5.1)
- [CVE-2023-46595](https://insights.sbomify.com/CVE-2023-46595/): Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor (medium 5.9)
- [CVE-2023-46590](https://insights.sbomify.com/CVE-2023-46590/): XML external entity in Siemens OPC UA Modelling Editor (SiOME) (high 7.5)
- [CVE-2023-4659](https://insights.sbomify.com/CVE-2023-4659/): Cross-Site Request Forgery in Free5Gc (critical 9.8)
- [CVE-2023-46589](https://insights.sbomify.com/CVE-2023-46589/): Apache Tomcat: HTTP request smuggling via malformed trailer headers (high 7.5)
- [CVE-2023-46587](https://insights.sbomify.com/CVE-2023-46587/): Memory corruption in xnview:xnview (high 7.8)
- [CVE-2023-46586](https://insights.sbomify.com/CVE-2023-46586/): cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused. (critical 9.1)
- [CVE-2023-46584](https://insights.sbomify.com/CVE-2023-46584/): SQL injection in phpgurukul:nipah virus testing management system (critical 9.8)
- [CVE-2023-46583](https://insights.sbomify.com/CVE-2023-46583/): Cross-site scripting in phpgurukul:nipah virus testing management system (medium 6.1)
- [CVE-2023-46582](https://insights.sbomify.com/CVE-2023-46582/): SQL injection in code-projects:inventory management (high 7.8)
- [CVE-2023-46581](https://insights.sbomify.com/CVE-2023-46581/): SQL injection in code-projects:inventory management (medium 5.5)
- [CVE-2023-46580](https://insights.sbomify.com/CVE-2023-46580/): Cross-site scripting in code-projects:inventory management (medium 5.4)
- [CVE-2023-4658](https://insights.sbomify.com/CVE-2023-4658/): Incorrect Authorization in GitLab (low 3.1)
- [CVE-2023-46575](https://insights.sbomify.com/CVE-2023-46575/): SQL injection vulnerability in Meshery (critical 9.8)
- [CVE-2023-46574](https://insights.sbomify.com/CVE-2023-46574/): Command injection in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-46570](https://insights.sbomify.com/CVE-2023-46570/): Memory corruption in radare:radare2 (critical 9.8)
- [CVE-2023-46569](https://insights.sbomify.com/CVE-2023-46569/): Memory corruption in radare:radare2 (critical 9.8)
- [CVE-2023-46566](https://insights.sbomify.com/CVE-2023-46566/): Buffer Overflow vulnerability in msoulier tftpy commit 467017b844bf6e31745138a30e2509145b0c529c allows a remote attacker to cause a denial o (high 7.5)
- [CVE-2023-46565](https://insights.sbomify.com/CVE-2023-46565/): Buffer Overflow vulnerability in osrg gobgp (high 7.5)
- [CVE-2023-46564](https://insights.sbomify.com/CVE-2023-46564/): Memory corruption in totolink:x2000r firmware (high 8.0)
- [CVE-2023-46563](https://insights.sbomify.com/CVE-2023-46563/): Memory corruption in totolink:x2000r firmware (high 8.0)
- [CVE-2023-46562](https://insights.sbomify.com/CVE-2023-46562/): Memory corruption in totolink:x2000r firmware (high 8.0)
- [CVE-2023-46560](https://insights.sbomify.com/CVE-2023-46560/): Memory corruption in totolink:x2000r firmware (high 8.0)
- [CVE-2023-46559](https://insights.sbomify.com/CVE-2023-46559/): Memory corruption in totolink:x2000r firmware (high 8.0)
- [CVE-2023-46558](https://insights.sbomify.com/CVE-2023-46558/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46557](https://insights.sbomify.com/CVE-2023-46557/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46556](https://insights.sbomify.com/CVE-2023-46556/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46555](https://insights.sbomify.com/CVE-2023-46555/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46554](https://insights.sbomify.com/CVE-2023-46554/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46553](https://insights.sbomify.com/CVE-2023-46553/): Memory corruption in totolink:x2000r firmware (high 8.0)
- [CVE-2023-46552](https://insights.sbomify.com/CVE-2023-46552/): Memory corruption in totolink:x2000r firmware (high 8.0)
- [CVE-2023-46551](https://insights.sbomify.com/CVE-2023-46551/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-46550](https://insights.sbomify.com/CVE-2023-46550/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-4655](https://insights.sbomify.com/CVE-2023-4655/): Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 (medium 4.3)
- [CVE-2023-46549](https://insights.sbomify.com/CVE-2023-46549/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-46548](https://insights.sbomify.com/CVE-2023-46548/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-46547](https://insights.sbomify.com/CVE-2023-46547/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-46546](https://insights.sbomify.com/CVE-2023-46546/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-46545](https://insights.sbomify.com/CVE-2023-46545/): Memory corruption in totolink:x2000r firmware (critical 9.8)
- [CVE-2023-46544](https://insights.sbomify.com/CVE-2023-46544/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46543](https://insights.sbomify.com/CVE-2023-46543/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46542](https://insights.sbomify.com/CVE-2023-46542/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46541](https://insights.sbomify.com/CVE-2023-46541/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-46540](https://insights.sbomify.com/CVE-2023-46540/): Memory corruption in totolink:x2000r firmware (high 8.8)
- [CVE-2023-4654](https://insights.sbomify.com/CVE-2023-4654/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2 (low 2.6)
- [CVE-2023-46539](https://insights.sbomify.com/CVE-2023-46539/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46538](https://insights.sbomify.com/CVE-2023-46538/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46537](https://insights.sbomify.com/CVE-2023-46537/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46536](https://insights.sbomify.com/CVE-2023-46536/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46535](https://insights.sbomify.com/CVE-2023-46535/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46534](https://insights.sbomify.com/CVE-2023-46534/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-4653](https://insights.sbomify.com/CVE-2023-4653/): Cross-site Scripting (XSS) - Stored in instantsoft/icms2 (medium 5.9)
- [CVE-2023-46527](https://insights.sbomify.com/CVE-2023-46527/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46526](https://insights.sbomify.com/CVE-2023-46526/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46525](https://insights.sbomify.com/CVE-2023-46525/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46523](https://insights.sbomify.com/CVE-2023-46523/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46522](https://insights.sbomify.com/CVE-2023-46522/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46521](https://insights.sbomify.com/CVE-2023-46521/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-46520](https://insights.sbomify.com/CVE-2023-46520/): Memory corruption in tp-link:tl-wr886n firmware (high 8.8)
- [CVE-2023-4652](https://insights.sbomify.com/CVE-2023-4652/): Cross-site Scripting (XSS) - Stored in instantsoft/icms2 (medium 6.8)
- [CVE-2023-46518](https://insights.sbomify.com/CVE-2023-46518/): Memory corruption in mercurycom:a15 firmware (critical 9.8)
- [CVE-2023-46510](https://insights.sbomify.com/CVE-2023-46510/): Command injection in zioncom:a7000r firmware (critical 9.8)
- [CVE-2023-4651](https://insights.sbomify.com/CVE-2023-4651/): Server-Side Request Forgery (SSRF) in instantsoft/icms2 (medium 6.4)
- [CVE-2023-46509](https://insights.sbomify.com/CVE-2023-46509/): Code injection in contec:solarview compact firmware (critical 9.8)
- [CVE-2023-46505](https://insights.sbomify.com/CVE-2023-46505/): Cross-site scripting in pwncyn:fancms (medium 6.1)
- [CVE-2023-46504](https://insights.sbomify.com/CVE-2023-46504/): Cross-site scripting in pwncyn:yxbookcms (medium 5.4)
- [CVE-2023-46503](https://insights.sbomify.com/CVE-2023-46503/): Cross-site scripting in pwncyn:yxbookcms (medium 6.1)
- [CVE-2023-46502](https://insights.sbomify.com/CVE-2023-46502/): OpenCRX allows a remote attacker to execute arbitrary code via a crafted request (critical 9.8)
- [CVE-2023-46501](https://insights.sbomify.com/CVE-2023-46501/): Missing authorization in boltwire:boltwire (critical 9.1)
- [CVE-2023-4650](https://insights.sbomify.com/CVE-2023-4650/): Improper Access Control in instantsoft/icms2 (medium 4.7)
- [CVE-2023-46499](https://insights.sbomify.com/CVE-2023-46499/): Cross-site Scripting in evershop (medium 6.1)
- [CVE-2023-46498](https://insights.sbomify.com/CVE-2023-46498/): Code execution in evershop (critical 9.8)
- [CVE-2023-46497](https://insights.sbomify.com/CVE-2023-46497/): Directory Traversal in evershop (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/203/