# Vulnerabilities published in 2023 - [CVE-2023-45136](https://insights.sbomify.com/CVE-2023-45136/): XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled (critical 9.7) - [CVE-2023-45135](https://insights.sbomify.com/CVE-2023-45135/): XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title (critical 9.1) - [CVE-2023-45134](https://insights.sbomify.com/CVE-2023-45134/): XWiki Platform XSS vulnerability from account in the create page form via template provider (critical 9.1) - [CVE-2023-45133](https://insights.sbomify.com/CVE-2023-45133/): Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (critical 9.4) - [CVE-2023-45132](https://insights.sbomify.com/CVE-2023-45132/): IgnoreIP/IgnoreCIDR should not trust X-Forwarded-For (critical 9.1) - [CVE-2023-45131](https://insights.sbomify.com/CVE-2023-45131/): Unauthenticated access to new private chat messages in Discourse (high 7.5) - [CVE-2023-45130](https://insights.sbomify.com/CVE-2023-45130/): Frontier opcode SUICIDE touches too many storage values on large contracts (high 7.5) - [CVE-2023-4513](https://insights.sbomify.com/CVE-2023-4513/): Missing Release of Memory after Effective Lifetime in Wireshark (medium 5.3) - [CVE-2023-45129](https://insights.sbomify.com/CVE-2023-45129/): matrix-synapse vulnerable to denial of service due to malicious server ACL events (medium 4.9) - [CVE-2023-45128](https://insights.sbomify.com/CVE-2023-45128/): CSRF Token Reuse Vulnerability in fiber (critical 10.0) - [CVE-2023-45121](https://insights.sbomify.com/CVE-2023-45121/): Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8) - [CVE-2023-45120](https://insights.sbomify.com/CVE-2023-45120/): Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8) - [CVE-2023-4512](https://insights.sbomify.com/CVE-2023-4512/): Uncontrolled Recursion in Wireshark (medium 5.3) - [CVE-2023-45119](https://insights.sbomify.com/CVE-2023-45119/): Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8) - [CVE-2023-45118](https://insights.sbomify.com/CVE-2023-45118/): Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8) - [CVE-2023-45117](https://insights.sbomify.com/CVE-2023-45117/): Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8) - [CVE-2023-45116](https://insights.sbomify.com/CVE-2023-45116/): Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8) - [CVE-2023-45115](https://insights.sbomify.com/CVE-2023-45115/): Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8) - [CVE-2023-45111](https://insights.sbomify.com/CVE-2023-45111/): Online Examination System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-45110](https://insights.sbomify.com/CVE-2023-45110/): WordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerability (medium 4.3) - [CVE-2023-4511](https://insights.sbomify.com/CVE-2023-4511/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.3) - [CVE-2023-45109](https://insights.sbomify.com/CVE-2023-45109/): WordPress WhitePage Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-45108](https://insights.sbomify.com/CVE-2023-45108/): WordPress Mailrelay Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-45107](https://insights.sbomify.com/CVE-2023-45107/): WordPress GoodBarber Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-45106](https://insights.sbomify.com/CVE-2023-45106/): WordPress Urvanov Syntax Highlighter Plugin <= 2.8.33 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-45105](https://insights.sbomify.com/CVE-2023-45105/): WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open Redirection (medium 4.7) - [CVE-2023-45104](https://insights.sbomify.com/CVE-2023-45104/): WordPress BetterLinks plugin <= 1.6.0 - Broken Access Control vulnerability (high 7.3) - [CVE-2023-45103](https://insights.sbomify.com/CVE-2023-45103/): WordPress Permalinks Customizer Plugin <= 2.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-45102](https://insights.sbomify.com/CVE-2023-45102/): WordPress Blog Manager Light Plugin <= 1.20 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-45101](https://insights.sbomify.com/CVE-2023-45101/): WordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerability (medium 4.3) - [CVE-2023-4509](https://insights.sbomify.com/CVE-2023-4509/): Information disclosure in Octopus Server (medium 4.3) - [CVE-2023-45085](https://insights.sbomify.com/CVE-2023-45085/): When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT" (low 3.2) - [CVE-2023-45084](https://insights.sbomify.com/CVE-2023-45084/): Media caddy removal and reinsertion without reboot may cause data loss (high 7.0) - [CVE-2023-45083](https://insights.sbomify.com/CVE-2023-45083/): HyperCloud: "admin" and "serveradmin" users can be deleted (medium 4.2) - [CVE-2023-4508](https://insights.sbomify.com/CVE-2023-4508/): Denial of Service in Gerbv (medium 5.5) - [CVE-2023-45079](https://insights.sbomify.com/CVE-2023-45079/): Memory corruption in BIOS (medium 6.7) - [CVE-2023-45078](https://insights.sbomify.com/CVE-2023-45078/): Memory corruption in BIOS (medium 6.7) - [CVE-2023-45077](https://insights.sbomify.com/CVE-2023-45077/): Memory corruption in BIOS (medium 6.7) - [CVE-2023-45076](https://insights.sbomify.com/CVE-2023-45076/): Memory corruption in BIOS (medium 6.7) - [CVE-2023-45075](https://insights.sbomify.com/CVE-2023-45075/): Memory corruption in BIOS (medium 6.7) - [CVE-2023-45074](https://insights.sbomify.com/CVE-2023-45074/): WordPress Advanced Page Visit Counter Plugin <= 7.1.1 is vulnerable to SQL Injection (high 8.5) - [CVE-2023-45073](https://insights.sbomify.com/CVE-2023-45073/): WordPress Mendeley Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-45072](https://insights.sbomify.com/CVE-2023-45072/): WordPress Order auto complete for WooCommerce Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-45071](https://insights.sbomify.com/CVE-2023-45071/): WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-45070](https://insights.sbomify.com/CVE-2023-45070/): WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-4507](https://insights.sbomify.com/CVE-2023-4507/): Admission AppManager <= 1.0.0 - Reflected Cross-Site Scripting (medium 6.1) - [CVE-2023-45069](https://insights.sbomify.com/CVE-2023-45069/): WordPress Video Gallery – YouTube Gallery Plugin <= 2.1.3 is vulnerable to SQL Injection (high 7.6) - [CVE-2023-45068](https://insights.sbomify.com/CVE-2023-45068/): WordPress Contact Form by Supsystic Plugin <= 1.7.27 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-45067](https://insights.sbomify.com/CVE-2023-45067/): WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-45066](https://insights.sbomify.com/CVE-2023-45066/): WordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data Exposure (medium 5.9) - [CVE-2023-45065](https://insights.sbomify.com/CVE-2023-45065/): WordPress Bulk NoIndex & NoFollow Toolkit Plugin <= 1.42 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-45064](https://insights.sbomify.com/CVE-2023-45064/): WordPress OPcache Dashboard Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-45063](https://insights.sbomify.com/CVE-2023-45063/): Cross-site request forgery in AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One (medium 4.3) - [CVE-2023-45062](https://insights.sbomify.com/CVE-2023-45062/): WordPress Download canvasio3D Light Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-45061](https://insights.sbomify.com/CVE-2023-45061/): WordPress WP Job Openings plugin <= 3.4.1 - Broken Access Control vulnerability (medium 5.3) - [CVE-2023-45060](https://insights.sbomify.com/CVE-2023-45060/): WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-4506](https://insights.sbomify.com/CVE-2023-4506/): Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback (low 2.2) - [CVE-2023-45059](https://insights.sbomify.com/CVE-2023-45059/): WordPress Gumroad Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-45058](https://insights.sbomify.com/CVE-2023-45058/): WordPress Short URL Plugin <= 1.6.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-45057](https://insights.sbomify.com/CVE-2023-45057/): WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-45056](https://insights.sbomify.com/CVE-2023-45056/): WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-45055](https://insights.sbomify.com/CVE-2023-45055/): WordPress MStore API Plugin <= 4.0.6 is vulnerable to SQL Injection (high 8.5) - [CVE-2023-45054](https://insights.sbomify.com/CVE-2023-45054/): WordPress Product Category Tree Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-45053](https://insights.sbomify.com/CVE-2023-45053/): WordPress WP Content Pilot plugin <= 1.3.3 - HTML Injection vulnerability (medium 4.3) - [CVE-2023-45052](https://insights.sbomify.com/CVE-2023-45052/): WordPress WP Bing Map Pro Plugin < 5.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-45051](https://insights.sbomify.com/CVE-2023-45051/): WordPress Image vertical reel scroll slideshow Plugin <= 9.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-45050](https://insights.sbomify.com/CVE-2023-45050/): WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-4505](https://insights.sbomify.com/CVE-2023-4505/): Staff / Employee Business Directory for Active Directory <= 1.2.3 - Authenticated (Admin+) LDAP Passback (low 2.2) - [CVE-2023-45049](https://insights.sbomify.com/CVE-2023-45049/): WordPress YouTube Playlist Player Plugin <= 4.6.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-45048](https://insights.sbomify.com/CVE-2023-45048/): Cross-site request forgery in Social proof testimonials and reviews by Repuso (medium 5.4) - [CVE-2023-45047](https://insights.sbomify.com/CVE-2023-45047/): WordPress LeadSquared Suite Plugin <= 0.7.4 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1) - [CVE-2023-45046](https://insights.sbomify.com/CVE-2023-45046/): WordPress Pressference Exporter Plugin <= 1.0.3 is vulnerable to SQL Injection (medium 5.5) - [CVE-2023-45045](https://insights.sbomify.com/CVE-2023-45045/): WordPress WP Custom Widget area plugin <= 1.2.5 - Broken Access Control vulnerability (medium 5.4) - [CVE-2023-45044](https://insights.sbomify.com/CVE-2023-45044/): QTS, QuTS hero (low 3.8) - [CVE-2023-45043](https://insights.sbomify.com/CVE-2023-45043/): QTS, QuTS hero (low 3.8) - [CVE-2023-45042](https://insights.sbomify.com/CVE-2023-45042/): QTS, QuTS hero (low 3.8) - [CVE-2023-45041](https://insights.sbomify.com/CVE-2023-45041/): QTS, QuTS hero (low 3.8) - [CVE-2023-45040](https://insights.sbomify.com/CVE-2023-45040/): QTS, QuTS hero (low 3.8) - [CVE-2023-4504](https://insights.sbomify.com/CVE-2023-4504/): OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow (high 7.0) - [CVE-2023-45039](https://insights.sbomify.com/CVE-2023-45039/): QTS, QuTS hero (low 3.8) - [CVE-2023-45038](https://insights.sbomify.com/CVE-2023-45038/): Music Station (medium 4.3) - [CVE-2023-45037](https://insights.sbomify.com/CVE-2023-45037/): QTS, QuTS hero, QuTScloud (low 3.8) - [CVE-2023-45036](https://insights.sbomify.com/CVE-2023-45036/): QTS, QuTS hero, QuTScloud (low 3.8) - [CVE-2023-45035](https://insights.sbomify.com/CVE-2023-45035/): QTS, QuTS hero, QuTScloud (low 3.8) - [CVE-2023-4503](https://insights.sbomify.com/CVE-2023-4503/): Eap-galleon: custom provisioning creates unsecured http-invoker (medium 6.8) - [CVE-2023-45028](https://insights.sbomify.com/CVE-2023-45028/): QTS, QuTS hero, QuTScloud (medium 5.5) - [CVE-2023-45027](https://insights.sbomify.com/CVE-2023-45027/): QTS, QuTS hero, QuTScloud (medium 5.5) - [CVE-2023-45026](https://insights.sbomify.com/CVE-2023-45026/): QTS, QuTS hero, QuTScloud (medium 5.5) - [CVE-2023-45025](https://insights.sbomify.com/CVE-2023-45025/): QTS, QuTS hero, QuTScloud (critical 9.0) - [CVE-2023-45024](https://insights.sbomify.com/CVE-2023-45024/): Information disclosure in bestpractical:request tracker (high 7.5) - [CVE-2023-45023](https://insights.sbomify.com/CVE-2023-45023/): TYPO3 extension femanager Broken Access Control vulnerability (medium 4.2) - [CVE-2023-4502](https://insights.sbomify.com/CVE-2023-4502/): Translate WordPress with GTranslate < 3.0.4 - Admin+ Stored XSS (medium 4.8) - [CVE-2023-45019](https://insights.sbomify.com/CVE-2023-45019/): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-45018](https://insights.sbomify.com/CVE-2023-45018/): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-45015](https://insights.sbomify.com/CVE-2023-45015/): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-45012](https://insights.sbomify.com/CVE-2023-45012/): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8) - [CVE-2023-45011](https://insights.sbomify.com/CVE-2023-45011/): WordPress WP Power Stats Plugin <= 2.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-45010](https://insights.sbomify.com/CVE-2023-45010/): WordPress Complete Open Graph Plugin <= 3.4.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-4501](https://insights.sbomify.com/CVE-2023-4501/): Authentication bypass in OpenText (Micro Focus) Enterprise Server (critical 9.8) - [CVE-2023-45009](https://insights.sbomify.com/CVE-2023-45009/): WordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerability (medium 5.3) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/214/