# Vulnerabilities published in 2023


- [CVE-2023-45614](https://insights.sbomify.com/CVE-2023-45614/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2023-45613](https://insights.sbomify.com/CVE-2023-45613/): Security feature bypass in Ktor (medium 6.8)
- [CVE-2023-45612](https://insights.sbomify.com/CVE-2023-45612/): XML external entity in Ktor (high 8.6)
- [CVE-2023-4561](https://insights.sbomify.com/CVE-2023-4561/): Cross-site Scripting (XSS) - Stored in omeka/omeka-s (high 7.1)
- [CVE-2023-45609](https://insights.sbomify.com/CVE-2023-45609/): WordPress Powr Pack Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-45608](https://insights.sbomify.com/CVE-2023-45608/): WordPress Smart Cookie Kit Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-45607](https://insights.sbomify.com/CVE-2023-45607/): WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-45606](https://insights.sbomify.com/CVE-2023-45606/): WordPress Simple URLs Plugin <= 120 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45605](https://insights.sbomify.com/CVE-2023-45605/): WordPress Feed Statistics Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45604](https://insights.sbomify.com/CVE-2023-45604/): WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45603](https://insights.sbomify.com/CVE-2023-45603/): WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File Upload (critical 9.0)
- [CVE-2023-45602](https://insights.sbomify.com/CVE-2023-45602/): WordPress Ebook Store Plugin <= 5.785 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45601](https://insights.sbomify.com/CVE-2023-45601/): Memory corruption in Parasolid V35.0 (high 7.8)
- [CVE-2023-45600](https://insights.sbomify.com/CVE-2023-45600/): Auth bypass in imx6 bundle (medium 5.6)
- [CVE-2023-4560](https://insights.sbomify.com/CVE-2023-4560/): Improper Authorization of Index Containing Sensitive Information in omeka/omeka-s (medium 6.5)
- [CVE-2023-45599](https://insights.sbomify.com/CVE-2023-45599/): File upload in imx6 bundle (medium 5.5)
- [CVE-2023-45598](https://insights.sbomify.com/CVE-2023-45598/): Missing authorization in imx6 bundle (medium 5.3)
- [CVE-2023-45597](https://insights.sbomify.com/CVE-2023-45597/): Code injection in imx6 bundle (medium 5.9)
- [CVE-2023-45596](https://insights.sbomify.com/CVE-2023-45596/): Missing authorization in imx6 bundle (medium 5.3)
- [CVE-2023-45595](https://insights.sbomify.com/CVE-2023-45595/): File upload in imx6 bundle (medium 5.9)
- [CVE-2023-45594](https://insights.sbomify.com/CVE-2023-45594/): Information disclosure in imx6 bundle (medium 6.8)
- [CVE-2023-45593](https://insights.sbomify.com/CVE-2023-45593/): Security feature bypass in imx6 bundle (medium 6.8)
- [CVE-2023-45592](https://insights.sbomify.com/CVE-2023-45592/): Privilege escalation in imx6 bundle (medium 6.8)
- [CVE-2023-45591](https://insights.sbomify.com/CVE-2023-45591/): Memory corruption in imx6 bundle (high 7.5)
- [CVE-2023-45590](https://insights.sbomify.com/CVE-2023-45590/): Code injection in FortiClientLinux (critical 9.4)
- [CVE-2023-4559](https://insights.sbomify.com/CVE-2023-4559/): Bettershop LaikeTui POST Request unrestricted upload (medium 6.3)
- [CVE-2023-45588](https://insights.sbomify.com/CVE-2023-45588/): Other in FortiClientMac (high 7.8)
- [CVE-2023-45587](https://insights.sbomify.com/CVE-2023-45587/): Cross-site scripting in FortiSandbox (low 3.4)
- [CVE-2023-45586](https://insights.sbomify.com/CVE-2023-45586/): Security feature bypass in FortiOS (medium 4.7)
- [CVE-2023-45585](https://insights.sbomify.com/CVE-2023-45585/): Information disclosure in FortiSIEM (low 2.1)
- [CVE-2023-45584](https://insights.sbomify.com/CVE-2023-45584/): Memory corruption in FortiOS (medium 6.3)
- [CVE-2023-45583](https://insights.sbomify.com/CVE-2023-45583/): Memory corruption in FortiOS (medium 6.2)
- [CVE-2023-45582](https://insights.sbomify.com/CVE-2023-45582/): Auth bypass in FortiMail (medium 5.3)
- [CVE-2023-45581](https://insights.sbomify.com/CVE-2023-45581/): Privilege escalation in FortiClientEMS (high 7.9)
- [CVE-2023-45580](https://insights.sbomify.com/CVE-2023-45580/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-4558](https://insights.sbomify.com/CVE-2023-4558/): SourceCodester Inventory Management System staff_data.php sql injection (medium 6.3)
- [CVE-2023-45579](https://insights.sbomify.com/CVE-2023-45579/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-45578](https://insights.sbomify.com/CVE-2023-45578/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-45577](https://insights.sbomify.com/CVE-2023-45577/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-45576](https://insights.sbomify.com/CVE-2023-45576/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-45575](https://insights.sbomify.com/CVE-2023-45575/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-45574](https://insights.sbomify.com/CVE-2023-45574/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-45573](https://insights.sbomify.com/CVE-2023-45573/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-45572](https://insights.sbomify.com/CVE-2023-45572/): Memory corruption in dlink:di-7003g firmware (critical 9.8)
- [CVE-2023-4557](https://insights.sbomify.com/CVE-2023-4557/): SourceCodester Inventory Management System search_purchase_paymen_report.php sql injection (medium 6.3)
- [CVE-2023-45561](https://insights.sbomify.com/CVE-2023-45561/): Information disclosure in linecorp:line (medium 5.3)
- [CVE-2023-45560](https://insights.sbomify.com/CVE-2023-45560/): Information disclosure in memberscard project:memberscard (high 7.5)
- [CVE-2023-4556](https://insights.sbomify.com/CVE-2023-4556/): SourceCodester Online Graduate Tracer System sexit.php mysqli_query sql injection (medium 6.3)
- [CVE-2023-45559](https://insights.sbomify.com/CVE-2023-45559/): Information disclosure in linecorp:line (high 8.2)
- [CVE-2023-45558](https://insights.sbomify.com/CVE-2023-45558/): Information disclosure in golden project:golden (high 7.5)
- [CVE-2023-45556](https://insights.sbomify.com/CVE-2023-45556/): Cross-site scripting in mybb:mybb (medium 5.4)
- [CVE-2023-45555](https://insights.sbomify.com/CVE-2023-45555/): File upload in zzzcms:zzzcms (high 7.8)
- [CVE-2023-45554](https://insights.sbomify.com/CVE-2023-45554/): File upload in zzzcms:zzzcms (critical 9.8)
- [CVE-2023-45552](https://insights.sbomify.com/CVE-2023-45552/): Cross-site scripting in veridiumid:veridiumad (medium 6.5)
- [CVE-2023-4555](https://insights.sbomify.com/CVE-2023-4555/): SourceCodester Inventory Management System suppliar_data.php cross site scripting (low 3.5)
- [CVE-2023-45542](https://insights.sbomify.com/CVE-2023-45542/): Cross-site scripting in moosocial:moosocial (medium 6.1)
- [CVE-2023-45540](https://insights.sbomify.com/CVE-2023-45540/): Cross-site scripting in jorani:leave management system (medium 6.5)
- [CVE-2023-4554](https://insights.sbomify.com/CVE-2023-4554/): XML External Entity (XXE) Processing (medium 4.9)
- [CVE-2023-45539](https://insights.sbomify.com/CVE-2023-45539/): Other in haproxy:haproxy (high 8.2)
- [CVE-2023-4553](https://insights.sbomify.com/CVE-2023-4553/): Unauthenticated Access to AppBuilder Configuration Files (medium 5.3)
- [CVE-2023-4552](https://insights.sbomify.com/CVE-2023-4552/): Java Database Connectivity (JDBC) URL Manipulation (medium 5.5)
- [CVE-2023-45511](https://insights.sbomify.com/CVE-2023-45511/): Denial of service in justdan96:tsmuxer (medium 5.5)
- [CVE-2023-45510](https://insights.sbomify.com/CVE-2023-45510/): Memory corruption in justdan96:tsmuxer (high 7.5)
- [CVE-2023-4551](https://insights.sbomify.com/CVE-2023-4551/): Command Injection via Task Scheduler (high 7.2)
- [CVE-2023-45503](https://insights.sbomify.com/CVE-2023-45503/): SQL injection in macs cms project:macs cms (medium 5.3)
- [CVE-2023-4550](https://insights.sbomify.com/CVE-2023-4550/): Unauthenticated Arbitrary File Read (high 7.5)
- [CVE-2023-45499](https://insights.sbomify.com/CVE-2023-45499/): Hardcoded credentials in vinchin:vinchin backup and recovery (critical 9.8)
- [CVE-2023-45498](https://insights.sbomify.com/CVE-2023-45498/): Command injection in vinchin:vinchin backup and recovery (critical 9.8)
- [CVE-2023-4549](https://insights.sbomify.com/CVE-2023-4549/): DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-45484](https://insights.sbomify.com/CVE-2023-45484/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-45483](https://insights.sbomify.com/CVE-2023-45483/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-45482](https://insights.sbomify.com/CVE-2023-45482/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-45481](https://insights.sbomify.com/CVE-2023-45481/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-45480](https://insights.sbomify.com/CVE-2023-45480/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-4548](https://insights.sbomify.com/CVE-2023-4548/): SPA-Cart eCommerce CMS GET Parameter search sql injection (medium 5.3)
- [CVE-2023-45479](https://insights.sbomify.com/CVE-2023-45479/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-45471](https://insights.sbomify.com/CVE-2023-45471/): Cross-site scripting in qad:search server (medium 5.4)
- [CVE-2023-4547](https://insights.sbomify.com/CVE-2023-4547/): SPA-Cart eCommerce CMS search cross site scripting (medium 5.1)
- [CVE-2023-45468](https://insights.sbomify.com/CVE-2023-45468/): Memory corruption in netis-systems:n3m firmware (high 7.5)
- [CVE-2023-45467](https://insights.sbomify.com/CVE-2023-45467/): Command injection in netis-systems:n3m firmware (critical 9.8)
- [CVE-2023-45466](https://insights.sbomify.com/CVE-2023-45466/): Command injection in netis-systems:n3mv2 firmware (critical 9.8)
- [CVE-2023-45465](https://insights.sbomify.com/CVE-2023-45465/): Command injection in netis-systems:n3m firmware (critical 9.8)
- [CVE-2023-45464](https://insights.sbomify.com/CVE-2023-45464/): Memory corruption in netis-systems:n3m firmware (high 7.5)
- [CVE-2023-45463](https://insights.sbomify.com/CVE-2023-45463/): Memory corruption in netis-systems:n3m firmware (high 7.5)
- [CVE-2023-4546](https://insights.sbomify.com/CVE-2023-4546/): Byzoro Smart S85F Management Platform licence.php access control (low 3.5)
- [CVE-2023-4545](https://insights.sbomify.com/CVE-2023-4545/): IBOS OA export&checkids=x sql injection (medium 6.3)
- [CVE-2023-4544](https://insights.sbomify.com/CVE-2023-4544/): Byzoro Smart S85F Management Platform php.ini direct request (medium 4.3)
- [CVE-2023-4543](https://insights.sbomify.com/CVE-2023-4543/): IBOS OA export&contactids=x sql injection (medium 6.3)
- [CVE-2023-4542](https://insights.sbomify.com/CVE-2023-4542/): D-Link DAR-8000-10 sys1.php os command injection (medium 6.3)
- [CVE-2023-4541](https://insights.sbomify.com/CVE-2023-4541/): SQLi in Weens Admin Panel (critical 9.8)
- [CVE-2023-4540](https://insights.sbomify.com/CVE-2023-4540/): DoS in lua-http library (high 7.5)
- [CVE-2023-45396](https://insights.sbomify.com/CVE-2023-45396/): Missing authorization in elenos:etg150 firmware (medium 6.5)
- [CVE-2023-45394](https://insights.sbomify.com/CVE-2023-45394/): Cross-site scripting in small crm project:small crm (medium 5.4)
- [CVE-2023-45393](https://insights.sbomify.com/CVE-2023-45393/): Missing authorization in grandingteco:utime master (medium 6.5)
- [CVE-2023-45391](https://insights.sbomify.com/CVE-2023-45391/): Cross-site scripting in grandingteco:utime master (medium 4.8)
- [CVE-2023-4539](https://insights.sbomify.com/CVE-2023-4539/): Hardcoded password in Comarch ERP XL (high 7.5)
- [CVE-2023-45387](https://insights.sbomify.com/CVE-2023-45387/): SQL injection in myprestamodules:exportproducts (critical 9.8)
- [CVE-2023-45386](https://insights.sbomify.com/CVE-2023-45386/): SQL injection in mypresta:product extra tabs pro (critical 9.8)
- [CVE-2023-45385](https://insights.sbomify.com/CVE-2023-45385/): ProQuality pqprintshippinglabels before v.4.15.0 is vulnerable to Directory Traversal via the pqprintshippinglabels module. (high 7.5)
- [CVE-2023-45384](https://insights.sbomify.com/CVE-2023-45384/): File upload in knowband:supercheckout (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/211/