# Vulnerabilities published in 2023


- [CVE-2023-46496](https://insights.sbomify.com/CVE-2023-46496/): Directory Traversal in evershop (high 8.3)
- [CVE-2023-46495](https://insights.sbomify.com/CVE-2023-46495/): Cross-site Scripting in evershop (medium 6.1)
- [CVE-2023-46494](https://insights.sbomify.com/CVE-2023-46494/): Cross Site Scripting in evershop (medium 6.1)
- [CVE-2023-46493](https://insights.sbomify.com/CVE-2023-46493/): Directory Traversal in evershop (medium 5.3)
- [CVE-2023-46492](https://insights.sbomify.com/CVE-2023-46492/): Cross-site scripting in mldb:machine learning database (medium 6.1)
- [CVE-2023-46491](https://insights.sbomify.com/CVE-2023-46491/): Cross-site scripting in zentao:biz (medium 6.1)
- [CVE-2023-46490](https://insights.sbomify.com/CVE-2023-46490/): SQL injection in cacti:cacti (medium 6.5)
- [CVE-2023-4649](https://insights.sbomify.com/CVE-2023-4649/): Session Fixation in instantsoft/icms2 (medium 4.3)
- [CVE-2023-46485](https://insights.sbomify.com/CVE-2023-46485/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46484](https://insights.sbomify.com/CVE-2023-46484/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46483](https://insights.sbomify.com/CVE-2023-46483/): Cross-site scripting in timeteccloud:auto web-based database management system (medium 5.4)
- [CVE-2023-46482](https://insights.sbomify.com/CVE-2023-46482/): SQL injection in wuzhicms:wuzhicms (critical 9.8)
- [CVE-2023-46480](https://insights.sbomify.com/CVE-2023-46480/): OwnCast remote code execution vulnerability (critical 9.8)
- [CVE-2023-4648](https://insights.sbomify.com/CVE-2023-4648/): WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-46478](https://insights.sbomify.com/CVE-2023-46478/): Code injection in minical:minical (high 8.8)
- [CVE-2023-46475](https://insights.sbomify.com/CVE-2023-46475/): Cross-site scripting in easycorp:zentao (medium 5.4)
- [CVE-2023-46474](https://insights.sbomify.com/CVE-2023-46474/): File upload in sigb:pmb (high 7.2)
- [CVE-2023-46471](https://insights.sbomify.com/CVE-2023-46471/): Cross-site scripting in spaceapplications:yacms (medium 5.4)
- [CVE-2023-46470](https://insights.sbomify.com/CVE-2023-46470/): Cross-site scripting in spaceapplications:yacms (medium 5.4)
- [CVE-2023-4647](https://insights.sbomify.com/CVE-2023-4647/): Allocation of Resources Without Limits or Throttling in GitLab (medium 5.3)
- [CVE-2023-46468](https://insights.sbomify.com/CVE-2023-46468/): juzawebCMS Injection vulnerability (high 7.8)
- [CVE-2023-46467](https://insights.sbomify.com/CVE-2023-46467/): Cross-site scripting in juzaweb:cms (medium 5.4)
- [CVE-2023-4646](https://insights.sbomify.com/CVE-2023-4646/): Simple Posts Ticker < 1.1.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-46456](https://insights.sbomify.com/CVE-2023-46456/): Command injection in gl-inet:gl-ar300m firmware (critical 9.8)
- [CVE-2023-46455](https://insights.sbomify.com/CVE-2023-46455/): Path traversal in gl-inet:gl-ar300m firmware (high 7.5)
- [CVE-2023-46454](https://insights.sbomify.com/CVE-2023-46454/): Command injection in gl-inet:gl-ar300m firmware (critical 9.8)
- [CVE-2023-46453](https://insights.sbomify.com/CVE-2023-46453/): Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username tha (critical 9.8)
- [CVE-2023-46451](https://insights.sbomify.com/CVE-2023-46451/): Cross-site scripting in mayurik:best courier management system (medium 5.4)
- [CVE-2023-46450](https://insights.sbomify.com/CVE-2023-46450/): Cross-site scripting in mayurik:inventory management system (medium 5.4)
- [CVE-2023-4645](https://insights.sbomify.com/CVE-2023-4645/): Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax (medium 5.3)
- [CVE-2023-46449](https://insights.sbomify.com/CVE-2023-46449/): Missing authorization in mayurik:inventory management system (high 8.8)
- [CVE-2023-46448](https://insights.sbomify.com/CVE-2023-46448/): Cross-site scripting in dmpop:mejiro (medium 6.1)
- [CVE-2023-46447](https://insights.sbomify.com/CVE-2023-46447/): Information disclosure in popsdiabetes:rebel (medium 4.3)
- [CVE-2023-46446](https://insights.sbomify.com/CVE-2023-46446/): AsyncSSH Rogue Session Attack (medium 6.8)
- [CVE-2023-46445](https://insights.sbomify.com/CVE-2023-46445/): AsyncSSH Rogue Extension Negotiation (medium 5.9)
- [CVE-2023-46442](https://insights.sbomify.com/CVE-2023-46442/): Soot Infinite Loop vulnerability (medium 4.3)
- [CVE-2023-46435](https://insights.sbomify.com/CVE-2023-46435/): SQL injection in oretnom23:packers and movers management system (critical 9.8)
- [CVE-2023-4643](https://insights.sbomify.com/CVE-2023-4643/): Enable Media Replace < 4.1.3 - Author+ PHP Object Injection (high 8.8)
- [CVE-2023-46428](https://insights.sbomify.com/CVE-2023-46428/): File upload in hadsky:hadsky (high 8.8)
- [CVE-2023-46427](https://insights.sbomify.com/CVE-2023-46427/): Null dereference in gpac:gpac (critical 9.8)
- [CVE-2023-46426](https://insights.sbomify.com/CVE-2023-46426/): Memory corruption in gpac:gpac (high 8.8)
- [CVE-2023-46424](https://insights.sbomify.com/CVE-2023-46424/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46423](https://insights.sbomify.com/CVE-2023-46423/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46422](https://insights.sbomify.com/CVE-2023-46422/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46421](https://insights.sbomify.com/CVE-2023-46421/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46420](https://insights.sbomify.com/CVE-2023-46420/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-4642](https://insights.sbomify.com/CVE-2023-4642/): kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition (medium 5.9)
- [CVE-2023-46419](https://insights.sbomify.com/CVE-2023-46419/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46418](https://insights.sbomify.com/CVE-2023-46418/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46417](https://insights.sbomify.com/CVE-2023-46417/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46416](https://insights.sbomify.com/CVE-2023-46416/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46415](https://insights.sbomify.com/CVE-2023-46415/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46414](https://insights.sbomify.com/CVE-2023-46414/): Command injection in totolink:x6000r firmware (high 8.8)
- [CVE-2023-46413](https://insights.sbomify.com/CVE-2023-46413/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46412](https://insights.sbomify.com/CVE-2023-46412/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46411](https://insights.sbomify.com/CVE-2023-46411/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46410](https://insights.sbomify.com/CVE-2023-46410/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-4641](https://insights.sbomify.com/CVE-2023-4641/): Shadow-utils: possible password leak during passwd(1) change (medium 4.7)
- [CVE-2023-46409](https://insights.sbomify.com/CVE-2023-46409/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46408](https://insights.sbomify.com/CVE-2023-46408/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46407](https://insights.sbomify.com/CVE-2023-46407/): Memory corruption in ffmpeg:ffmpeg (medium 5.5)
- [CVE-2023-46404](https://insights.sbomify.com/CVE-2023-46404/): Code injection in utoronto:pcrs (critical 9.9)
- [CVE-2023-46402](https://insights.sbomify.com/CVE-2023-46402/): Inefficient Regular Expression Complexity in git-urls (high 7.5)
- [CVE-2023-46401](https://insights.sbomify.com/CVE-2023-46401/): Code injection in kwhotel:kwhotel (high 8.8)
- [CVE-2023-46400](https://insights.sbomify.com/CVE-2023-46400/): Code injection in kwhotel:kwhotel (medium 4.3)
- [CVE-2023-4640](https://insights.sbomify.com/CVE-2023-4640/): Set Logging Level Without Authentication (medium 6.5)
- [CVE-2023-46396](https://insights.sbomify.com/CVE-2023-46396/): Cross-site scripting in web-audimex:audimex (medium 5.4)
- [CVE-2023-46394](https://insights.sbomify.com/CVE-2023-46394/): Cross-site scripting in gougucms:gougucms (medium 5.4)
- [CVE-2023-46393](https://insights.sbomify.com/CVE-2023-46393/): Business logic in gougucms:gougucms (high 7.5)
- [CVE-2023-4639](https://insights.sbomify.com/CVE-2023-4639/): Undertow: cookie smuggling/spoofing (high 7.4)
- [CVE-2023-46389](https://insights.sbomify.com/CVE-2023-46389/): Information disclosure in loytec:linx-151 firmware (high 7.5)
- [CVE-2023-46388](https://insights.sbomify.com/CVE-2023-46388/): Information disclosure in loytec:linx-151 firmware (high 7.5)
- [CVE-2023-46387](https://insights.sbomify.com/CVE-2023-46387/): Missing authorization in loytec:linx-151 firmware (high 7.5)
- [CVE-2023-46386](https://insights.sbomify.com/CVE-2023-46386/): Information disclosure in loytec:linx-151 firmware (high 7.5)
- [CVE-2023-46385](https://insights.sbomify.com/CVE-2023-46385/): Information disclosure in loytec:l-inx configurator (high 7.5)
- [CVE-2023-46384](https://insights.sbomify.com/CVE-2023-46384/): Information disclosure in loytec:l-inx configurator (high 7.5)
- [CVE-2023-46383](https://insights.sbomify.com/CVE-2023-46383/): Weak cryptography in loytec:l-inx configurator (high 7.5)
- [CVE-2023-46382](https://insights.sbomify.com/CVE-2023-46382/): Weak cryptography in loytec:linx-212 firmware (high 7.5)
- [CVE-2023-46381](https://insights.sbomify.com/CVE-2023-46381/): Missing authorization in loytec:linx-212 firmware (high 8.2)
- [CVE-2023-46380](https://insights.sbomify.com/CVE-2023-46380/): Information disclosure in loytec:linx-212 firmware (high 7.5)
- [CVE-2023-46378](https://insights.sbomify.com/CVE-2023-46378/): Cross-site scripting in 1234n:minicms (medium 5.4)
- [CVE-2023-46376](https://insights.sbomify.com/CVE-2023-46376/): Information disclosure in zentao:biz (high 7.5)
- [CVE-2023-46375](https://insights.sbomify.com/CVE-2023-46375/): Cross-site request forgery in zentao:biz (high 8.8)
- [CVE-2023-46374](https://insights.sbomify.com/CVE-2023-46374/): Cross-site scripting in zentao:biz (medium 6.1)
- [CVE-2023-46373](https://insights.sbomify.com/CVE-2023-46373/): Memory corruption in tp-link:tl-wdr7660 firmware (critical 9.8)
- [CVE-2023-46371](https://insights.sbomify.com/CVE-2023-46371/): Memory corruption in tp-link:tl-wdr7660 firmware (critical 9.8)
- [CVE-2023-46370](https://insights.sbomify.com/CVE-2023-46370/): Command injection in tenda:w18e firmware (critical 9.8)
- [CVE-2023-4637](https://insights.sbomify.com/CVE-2023-4637/): WPvivid <= 0.9.94 - Missing Authorization (medium 4.3)
- [CVE-2023-46369](https://insights.sbomify.com/CVE-2023-46369/): Memory corruption in tenda:w18e firmware (critical 9.8)
- [CVE-2023-46363](https://insights.sbomify.com/CVE-2023-46363/): Memory corruption in jbig2enc project:jbig2enc (medium 5.5)
- [CVE-2023-46362](https://insights.sbomify.com/CVE-2023-46362/): Use after free in jbig2enc project:jbig2enc (medium 5.5)
- [CVE-2023-46361](https://insights.sbomify.com/CVE-2023-46361/): Denial of service in artifex:jbig2dec (medium 6.5)
- [CVE-2023-46360](https://insights.sbomify.com/CVE-2023-46360/): Privilege escalation in hardy-barth:cph2 echarge firmware (high 8.8)
- [CVE-2023-4636](https://insights.sbomify.com/CVE-2023-4636/): WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-46359](https://insights.sbomify.com/CVE-2023-46359/): Command injection in hardy-barth:cph2 echarge firmware (critical 9.8)
- [CVE-2023-46358](https://insights.sbomify.com/CVE-2023-46358/): SQL injection in snegurka:referralbyphone (critical 9.8)
- [CVE-2023-46357](https://insights.sbomify.com/CVE-2023-46357/): SQL injection in myprestamodules:cross selling in modal cart (critical 9.8)
- [CVE-2023-46356](https://insights.sbomify.com/CVE-2023-46356/): SQL injection in blmodules:csv feeds pro (critical 9.8)
- [CVE-2023-46355](https://insights.sbomify.com/CVE-2023-46355/): Missing authorization in blmodules:csv feeds pro (medium 5.3)
- [CVE-2023-46354](https://insights.sbomify.com/CVE-2023-46354/): Missing authorization in myprestamodules:orders \(csv\, excel\) export pro (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/204/