# Vulnerabilities published in 2023


- [CVE-2023-45008](https://insights.sbomify.com/CVE-2023-45008/): WordPress Comment Reply Email Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45007](https://insights.sbomify.com/CVE-2023-45007/): WordPress Fotomoto Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45006](https://insights.sbomify.com/CVE-2023-45006/): WordPress WooODT Lite Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45005](https://insights.sbomify.com/CVE-2023-45005/): WordPress Seriously Simple Stats Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45004](https://insights.sbomify.com/CVE-2023-45004/): WordPress Woo Custom Emails Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45003](https://insights.sbomify.com/CVE-2023-45003/): WordPress Social Feed Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45002](https://insights.sbomify.com/CVE-2023-45002/): WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-45001](https://insights.sbomify.com/CVE-2023-45001/): WordPress Seriously Simple Stats Plugin <= 1.5.0 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-45000](https://insights.sbomify.com/CVE-2023-45000/): WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability (high 8.2)
- [CVE-2023-4500](https://insights.sbomify.com/CVE-2023-4500/): Order Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.7)
- [CVE-2023-44999](https://insights.sbomify.com/CVE-2023-44999/): WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-44998](https://insights.sbomify.com/CVE-2023-44998/): WordPress Category Meta Plugin <= 1.2.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44997](https://insights.sbomify.com/CVE-2023-44997/): WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-44996](https://insights.sbomify.com/CVE-2023-44996/): WordPress Post View Count Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-44995](https://insights.sbomify.com/CVE-2023-44995/): WordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-44994](https://insights.sbomify.com/CVE-2023-44994/): WordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44993](https://insights.sbomify.com/CVE-2023-44993/): WordPress ChatBot Plugin <= 4.7.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44991](https://insights.sbomify.com/CVE-2023-44991/): WordPress Media File Renamer Plugin <= 5.6.9 is vulnerable to Sensitive Data Exposure (medium 6.5)
- [CVE-2023-44990](https://insights.sbomify.com/CVE-2023-44990/): WordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4499](https://insights.sbomify.com/CVE-2023-4499/): Weak cryptography in HP ThinUpdate (high 7.5)
- [CVE-2023-44989](https://insights.sbomify.com/CVE-2023-44989/): WordPress CF7 Google Sheets Connector plugin <= 5.0.5 - Sensitive Data Exposure via Debug Log vulnerability (high 7.5)
- [CVE-2023-44988](https://insights.sbomify.com/CVE-2023-44988/): WordPress WP Custom Admin Interface plugin <= 7.32 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-44987](https://insights.sbomify.com/CVE-2023-44987/): WordPress Timely Booking Button Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44986](https://insights.sbomify.com/CVE-2023-44986/): WordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.15.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44985](https://insights.sbomify.com/CVE-2023-44985/): WordPress BuddyMeet Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-44984](https://insights.sbomify.com/CVE-2023-44984/): WordPress bbp style pack Plugin <= 5.6.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-44983](https://insights.sbomify.com/CVE-2023-44983/): WordPress Aruba HiSpeed Cache Plugin <= 2.0.6 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-44982](https://insights.sbomify.com/CVE-2023-44982/): WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-44981](https://insights.sbomify.com/CVE-2023-44981/): Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication (critical 9.1)
- [CVE-2023-4498](https://insights.sbomify.com/CVE-2023-4498/): Authentication Bypass in Tenda N300 Wireless N VDSL2 Modem Router (medium 5.3)
- [CVE-2023-44976](https://insights.sbomify.com/CVE-2023-44976/): Privilege escalation in Rentdrv2 (low 3.2)
- [CVE-2023-44974](https://insights.sbomify.com/CVE-2023-44974/): File upload in emlog:emlog (critical 9.8)
- [CVE-2023-44973](https://insights.sbomify.com/CVE-2023-44973/): File upload in emlog:emlog (critical 9.8)
- [CVE-2023-4497](https://insights.sbomify.com/CVE-2023-4497/): Easy Chat Server XSS vulnerability (medium 6.1)
- [CVE-2023-44962](https://insights.sbomify.com/CVE-2023-44962/): File upload in koha-community:koha library software (medium 5.3)
- [CVE-2023-44961](https://insights.sbomify.com/CVE-2023-44961/): SQL injection in koha-community:koha library software (high 7.5)
- [CVE-2023-4496](https://insights.sbomify.com/CVE-2023-4496/): Easy Chat Server XSS vulnerability (medium 6.1)
- [CVE-2023-44959](https://insights.sbomify.com/CVE-2023-44959/): Command injection in dlink:dsl-3782 firmware (high 8.8)
- [CVE-2023-44954](https://insights.sbomify.com/CVE-2023-44954/): Cross-site scripting in bigtreecms:bigtree cms (medium 5.4)
- [CVE-2023-4495](https://insights.sbomify.com/CVE-2023-4495/): Easy Chat Server XSS vulnerability (medium 6.1)
- [CVE-2023-4494](https://insights.sbomify.com/CVE-2023-4494/): Easy Chat Server Stack-based buffer overflow vulnerability (critical 9.8)
- [CVE-2023-4493](https://insights.sbomify.com/CVE-2023-4493/): Easy Address Book Web Server Stored XSS vulnerability (medium 6.1)
- [CVE-2023-4492](https://insights.sbomify.com/CVE-2023-4492/): Easy Address Book Web Server XSS vulnerability (medium 6.1)
- [CVE-2023-44915](https://insights.sbomify.com/CVE-2023-44915/): A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scrip (high 7.1)
- [CVE-2023-4491](https://insights.sbomify.com/CVE-2023-4491/): Easy Address Book Web Server Buffer overflow vulnerability (critical 9.8)
- [CVE-2023-4490](https://insights.sbomify.com/CVE-2023-4490/): WP Job Portal < 2.0.6 - Unauthenticated SQLi (critical 9.8)
- [CVE-2023-4489](https://insights.sbomify.com/CVE-2023-4489/): Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key (medium 6.4)
- [CVE-2023-4488](https://insights.sbomify.com/CVE-2023-4488/): Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2023-4487](https://insights.sbomify.com/CVE-2023-4487/): GE Digital CIMPLICITY Process Control (high 7.8)
- [CVE-2023-44860](https://insights.sbomify.com/CVE-2023-44860/): Denial of service in netis-systems:n3m firmware (high 7.5)
- [CVE-2023-4486](https://insights.sbomify.com/CVE-2023-4486/): Uncontrolled Resource Consumption in Metasys and Facility Explorer (high 7.5)
- [CVE-2023-44857](https://insights.sbomify.com/CVE-2023-44857/): Code injection in cobham:sailor 600 vsat ku firmware (high 8.1)
- [CVE-2023-44856](https://insights.sbomify.com/CVE-2023-44856/): Cross-site scripting in cobham:sailor 600 vsat ku firmware (medium 6.1)
- [CVE-2023-44855](https://insights.sbomify.com/CVE-2023-44855/): Cross-site scripting in cobham:sailor 600 vsat ku firmware (medium 6.5)
- [CVE-2023-44854](https://insights.sbomify.com/CVE-2023-44854/): Cross-site scripting in cobham:sailor 600 vsat ku firmware (medium 6.1)
- [CVE-2023-44853](https://insights.sbomify.com/CVE-2023-44853/): Code injection in cobham:sailor 600 vsat ku firmware (medium 4.8)
- [CVE-2023-44852](https://insights.sbomify.com/CVE-2023-44852/): Cross-site scripting in cobham:sailor 600 vsat ku firmware (high 8.2)
- [CVE-2023-4485](https://insights.sbomify.com/CVE-2023-4485/): ARDEREG Sistemas SCADA SQL Injection (critical 9.8)
- [CVE-2023-44848](https://insights.sbomify.com/CVE-2023-44848/): Code injection in seacms:seacms (high 8.1)
- [CVE-2023-44847](https://insights.sbomify.com/CVE-2023-44847/): Code injection in seacms:seacms (high 7.2)
- [CVE-2023-44846](https://insights.sbomify.com/CVE-2023-44846/): Code injection in seacms:seacms (high 8.8)
- [CVE-2023-44839](https://insights.sbomify.com/CVE-2023-44839/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44838](https://insights.sbomify.com/CVE-2023-44838/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44837](https://insights.sbomify.com/CVE-2023-44837/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44836](https://insights.sbomify.com/CVE-2023-44836/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44835](https://insights.sbomify.com/CVE-2023-44835/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44834](https://insights.sbomify.com/CVE-2023-44834/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44833](https://insights.sbomify.com/CVE-2023-44833/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44832](https://insights.sbomify.com/CVE-2023-44832/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44831](https://insights.sbomify.com/CVE-2023-44831/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44830](https://insights.sbomify.com/CVE-2023-44830/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44829](https://insights.sbomify.com/CVE-2023-44829/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44828](https://insights.sbomify.com/CVE-2023-44828/): Memory corruption in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-44827](https://insights.sbomify.com/CVE-2023-44827/): Command injection in easycorp:zentao (high 8.8)
- [CVE-2023-44826](https://insights.sbomify.com/CVE-2023-44826/): Cross-site scripting in easycorp:zentao (medium 5.4)
- [CVE-2023-44824](https://insights.sbomify.com/CVE-2023-44824/): File upload in oretnom23:expense management system (high 7.8)
- [CVE-2023-44821](https://insights.sbomify.com/CVE-2023-44821/): Denial of service in lcdf:gifsicle (medium 5.5)
- [CVE-2023-4482](https://insights.sbomify.com/CVE-2023-4482/): Auto Amazon Links <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via style (medium 6.4)
- [CVE-2023-44813](https://insights.sbomify.com/CVE-2023-44813/): Cross-site scripting in moosocial:moosocial (medium 6.1)
- [CVE-2023-44812](https://insights.sbomify.com/CVE-2023-44812/): Cross-site scripting in moosocial:moosocial (medium 6.1)
- [CVE-2023-44811](https://insights.sbomify.com/CVE-2023-44811/): Cross-site request forgery in moosocial:moosocial (high 8.8)
- [CVE-2023-4481](https://insights.sbomify.com/CVE-2023-4481/): Denial of service in Junos OS (high 7.5)
- [CVE-2023-44809](https://insights.sbomify.com/CVE-2023-44809/): Privilege escalation in dlink:dir-820l firmware (critical 9.8)
- [CVE-2023-44808](https://insights.sbomify.com/CVE-2023-44808/): Memory corruption in dlink:dir-820l firmware (critical 9.8)
- [CVE-2023-44807](https://insights.sbomify.com/CVE-2023-44807/): Memory corruption in dlink:dir-820l firmware (critical 9.8)
- [CVE-2023-4480](https://insights.sbomify.com/CVE-2023-4480/): Arbitrary File Read in Fusion File Manager (medium 5.5)
- [CVE-2023-44796](https://insights.sbomify.com/CVE-2023-44796/): Cross-site scripting in limesurvey:limesurvey (medium 5.4)
- [CVE-2023-44794](https://insights.sbomify.com/CVE-2023-44794/): SaToken privilege escalation vulnerability (critical 9.8)
- [CVE-2023-4479](https://insights.sbomify.com/CVE-2023-4479/): Stored XSS Vulnerability in M-Files Web (high 7.3)
- [CVE-2023-4478](https://insights.sbomify.com/CVE-2023-4478/): Parameter tampering in the registration resulting in blocked accounts to be created (medium 4.3)
- [CVE-2023-44771](https://insights.sbomify.com/CVE-2023-44771/): Zenario CMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-44770](https://insights.sbomify.com/CVE-2023-44770/): Zenario CMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-44769](https://insights.sbomify.com/CVE-2023-44769/): Zenario CMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-44767](https://insights.sbomify.com/CVE-2023-44767/): Cross-site scripting in ritecms:ritecms (medium 4.8)
- [CVE-2023-44766](https://insights.sbomify.com/CVE-2023-44766/): ConcreteCMS Cross-site Scripting vulnerability (medium 4.8)
- [CVE-2023-44765](https://insights.sbomify.com/CVE-2023-44765/): ConcreteCMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-44764](https://insights.sbomify.com/CVE-2023-44764/): ConcreteCMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-44763](https://insights.sbomify.com/CVE-2023-44763/): ConcreteCMS vulnerable to Stored Cross-site Scripting (medium 5.4)
- [CVE-2023-44762](https://insights.sbomify.com/CVE-2023-44762/): ConcreteCMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-44761](https://insights.sbomify.com/CVE-2023-44761/): ConcreteCMS Cross-site Scripting vulnerability (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/215/