# Vulnerabilities published in 2023


- [CVE-2023-44760](https://insights.sbomify.com/CVE-2023-44760/): Concrete CMS Cross-site Scripting vulnerability (medium 4.8)
- [CVE-2023-4476](https://insights.sbomify.com/CVE-2023-4476/): Locatoraid Store Locator < 3.9.24 - Reflected XSS (medium 6.1)
- [CVE-2023-44758](https://insights.sbomify.com/CVE-2023-44758/): Cross-site scripting in gdidees:gdidees cms (medium 5.4)
- [CVE-2023-44755](https://insights.sbomify.com/CVE-2023-44755/): SQL injection in mayurik:sacco management system (critical 9.8)
- [CVE-2023-44753](https://insights.sbomify.com/CVE-2023-44753/): Cross-site scripting in mayurik:online student management system (medium 6.1)
- [CVE-2023-44752](https://insights.sbomify.com/CVE-2023-44752/): Auth bypass in oretnom23:student study center desk management system (critical 9.8)
- [CVE-2023-4475](https://insights.sbomify.com/CVE-2023-4475/): An Arbitrary File Movement vulnerability was found on the ADM (high 7.5)
- [CVE-2023-4474](https://insights.sbomify.com/CVE-2023-4474/): Command injection in NAS326 firmware (critical 9.8)
- [CVE-2023-4473](https://insights.sbomify.com/CVE-2023-4473/): Command injection in NAS326 firmware (critical 9.8)
- [CVE-2023-4472](https://insights.sbomify.com/CVE-2023-4472/): Cryptographically weak PRNG in Opinio 7.22 (critical 9.8)
- [CVE-2023-4471](https://insights.sbomify.com/CVE-2023-4471/): Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-44709](https://insights.sbomify.com/CVE-2023-44709/): Integer overflow in sammycage:plutosvg (critical 9.8)
- [CVE-2023-44694](https://insights.sbomify.com/CVE-2023-44694/): SQL injection in dlink:dar-7000 firmware (critical 9.8)
- [CVE-2023-44693](https://insights.sbomify.com/CVE-2023-44693/): SQL injection in dlink:dar-7000 firmware (critical 9.8)
- [CVE-2023-44690](https://insights.sbomify.com/CVE-2023-44690/): mycli has Inadequate Encryption Strength (high 7.5)
- [CVE-2023-4469](https://insights.sbomify.com/CVE-2023-4469/): Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure (medium 5.3)
- [CVE-2023-44689](https://insights.sbomify.com/CVE-2023-44689/): Open redirect in e-Gov Client Application (Windows version) (medium 4.3)
- [CVE-2023-4468](https://insights.sbomify.com/CVE-2023-4468/): Poly Trio 8500/Trio 8800/Trio C60 Poly Lens Management Cloud Registration authorization (medium 4.3)
- [CVE-2023-4467](https://insights.sbomify.com/CVE-2023-4467/): Poly Trio 8800 Test Automation Mode backdoor (medium 6.2)
- [CVE-2023-4466](https://insights.sbomify.com/CVE-2023-4466/): Poly CCX 400/CCX 600/Trio 8800/Trio C60 Web Interface protection mechanism (low 2.7)
- [CVE-2023-4465](https://insights.sbomify.com/CVE-2023-4465/): Poly VVX 601 Configuration File Import unverified password change (low 2.7)
- [CVE-2023-4464](https://insights.sbomify.com/CVE-2023-4464/): Poly VVX 601 Diagnostic Telnet Mode os command injection (high 7.2)
- [CVE-2023-4463](https://insights.sbomify.com/CVE-2023-4463/): Poly CCX 400/CCX 600/Trio 8800/Trio C60 HTTP Header denial of service (medium 5.3)
- [CVE-2023-4462](https://insights.sbomify.com/CVE-2023-4462/): Poly VVX 601 Web Configuration Application random values (low 3.7)
- [CVE-2023-4460](https://insights.sbomify.com/CVE-2023-4460/): Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG (medium 6.1)
- [CVE-2023-4459](https://insights.sbomify.com/CVE-2023-4459/): Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup() (medium 5.5)
- [CVE-2023-4458](https://insights.sbomify.com/CVE-2023-4458/): Kernel: ksmbd: smb2_open out-of-bounds read information disclosure vulnerability (medium 4.0)
- [CVE-2023-4457](https://insights.sbomify.com/CVE-2023-4457/): Google Sheets data source plugin for Grafana information disclosure vulnerability (medium 5.5)
- [CVE-2023-4456](https://insights.sbomify.com/CVE-2023-4456/): Openshift-logging: lokistack authorisation is cached too broadly (medium 5.7)
- [CVE-2023-4455](https://insights.sbomify.com/CVE-2023-4455/): Cross-Site Request Forgery (CSRF) in wallabag/wallabag (medium 6.5)
- [CVE-2023-4454](https://insights.sbomify.com/CVE-2023-4454/): Cross-Site Request Forgery (CSRF) in wallabag/wallabag (medium 4.3)
- [CVE-2023-4453](https://insights.sbomify.com/CVE-2023-4453/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 6.4)
- [CVE-2023-4452](https://insights.sbomify.com/CVE-2023-4452/): Web Server Buffer Overflow Vulnerability (medium 6.5)
- [CVE-2023-4451](https://insights.sbomify.com/CVE-2023-4451/): Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit (medium 6.1)
- [CVE-2023-4450](https://insights.sbomify.com/CVE-2023-4450/): jeecgboot JimuReport Template injection (medium 6.3)
- [CVE-2023-4449](https://insights.sbomify.com/CVE-2023-4449/): SourceCodester Free and Open Source Inventory Management System sql injection (medium 6.3)
- [CVE-2023-44488](https://insights.sbomify.com/CVE-2023-44488/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2023-44487](https://insights.sbomify.com/CVE-2023-44487/): HTTP/2 Rapid Reset Attack (high 7.5, exploited in the wild)
- [CVE-2023-44484](https://insights.sbomify.com/CVE-2023-44484/): Online Blood Donation Management System v1.0 - Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2023-44483](https://insights.sbomify.com/CVE-2023-44483/): Apache Santuario: Private Key disclosure in debug-log output (medium 6.5)
- [CVE-2023-44482](https://insights.sbomify.com/CVE-2023-44482/): Leave Management System Project v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8)
- [CVE-2023-44481](https://insights.sbomify.com/CVE-2023-44481/): Leave Management System Project v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8)
- [CVE-2023-44480](https://insights.sbomify.com/CVE-2023-44480/): Leave Management System Project v1.0 - Multiple Authenticated SQL Injections (SQLi) (high 8.8)
- [CVE-2023-4448](https://insights.sbomify.com/CVE-2023-4448/): OpenRapid RapidCMS run-movepass.php password recovery (medium 6.3)
- [CVE-2023-44479](https://insights.sbomify.com/CVE-2023-44479/): WordPress WP Jump Menu Plugin <= 3.6.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44478](https://insights.sbomify.com/CVE-2023-44478/): WordPress Events Rich Snippets for Google plugin <= 1.8 - CSRF Leading to Privilege Escalation vulnerability (high 7.1)
- [CVE-2023-44477](https://insights.sbomify.com/CVE-2023-44477/): WordPress Cooked Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-44476](https://insights.sbomify.com/CVE-2023-44476/): WordPress CopyRightPro Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44475](https://insights.sbomify.com/CVE-2023-44475/): WordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-44474](https://insights.sbomify.com/CVE-2023-44474/): WordPress Tiger Forms Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-44473](https://insights.sbomify.com/CVE-2023-44473/): WordPress Table of Contents Plus Plugin <= 2302 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-44472](https://insights.sbomify.com/CVE-2023-44472/): WordPress Unyson plugin <= 2.7.28 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-44471](https://insights.sbomify.com/CVE-2023-44471/): WordPress Backend Localization Plugin <= 2.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44470](https://insights.sbomify.com/CVE-2023-44470/): WordPress Kv TinyMCE Editor Add Fonts Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-4447](https://insights.sbomify.com/CVE-2023-4447/): OpenRapid RapidCMS article-chat.php sql injection (medium 6.3)
- [CVE-2023-44469](https://insights.sbomify.com/CVE-2023-44469/): Server-side request forgery in lemonldap-ng:lemonldap\ (medium 4.3)
- [CVE-2023-44467](https://insights.sbomify.com/CVE-2023-44467/): langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method (critical 9.8)
- [CVE-2023-44466](https://insights.sbomify.com/CVE-2023-44466/): Integer overflow in linux:linux kernel (high 8.8)
- [CVE-2023-44464](https://insights.sbomify.com/CVE-2023-44464/): pretix allows Pillow to parse EPS files (high 7.8)
- [CVE-2023-44463](https://insights.sbomify.com/CVE-2023-44463/): pretix potential IP address spoofing vulnerability (medium 5.3)
- [CVE-2023-4446](https://insights.sbomify.com/CVE-2023-4446/): OpenRapid RapidCMS category.php sql injection (medium 5.5)
- [CVE-2023-44452](https://insights.sbomify.com/CVE-2023-44452/): Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44451](https://insights.sbomify.com/CVE-2023-44451/): Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44450](https://insights.sbomify.com/CVE-2023-44450/): NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-4445](https://insights.sbomify.com/CVE-2023-4445/): Mini-Tmall sql injection (medium 6.3)
- [CVE-2023-44449](https://insights.sbomify.com/CVE-2023-44449/): NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability (high 8.8)
- [CVE-2023-44448](https://insights.sbomify.com/CVE-2023-44448/): TP-Link Archer A54 libcmm.so dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-44447](https://insights.sbomify.com/CVE-2023-44447/): TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-44446](https://insights.sbomify.com/CVE-2023-44446/): GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-44445](https://insights.sbomify.com/CVE-2023-44445/): NETGEAR CAX30 SSO Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-44444](https://insights.sbomify.com/CVE-2023-44444/): GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44443](https://insights.sbomify.com/CVE-2023-44443/): GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44442](https://insights.sbomify.com/CVE-2023-44442/): GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44441](https://insights.sbomify.com/CVE-2023-44441/): GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44440](https://insights.sbomify.com/CVE-2023-44440/): Ashlar-Vellum Lithium Uncontrolled Search Path Element Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-4444](https://insights.sbomify.com/CVE-2023-4444/): SourceCodester Free Hospital Management System for Small Practices edit-user.php sql injection (medium 6.3)
- [CVE-2023-44439](https://insights.sbomify.com/CVE-2023-44439/): Ashlar-Vellum Xenon Uncontrolled Search Path Element Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44438](https://insights.sbomify.com/CVE-2023-44438/): Ashlar-Vellum Argon Uncontrolled Search Path Element Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44437](https://insights.sbomify.com/CVE-2023-44437/): Ashlar-Vellum Cobalt Uncontrolled Search Path Element Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44436](https://insights.sbomify.com/CVE-2023-44436/): Kofax Power PDF File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44435](https://insights.sbomify.com/CVE-2023-44435/): Kofax Power PDF File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44434](https://insights.sbomify.com/CVE-2023-44434/): Kofax Power PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-44433](https://insights.sbomify.com/CVE-2023-44433/): Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-44432](https://insights.sbomify.com/CVE-2023-44432/): Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44431](https://insights.sbomify.com/CVE-2023-44431/): BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.1)
- [CVE-2023-44430](https://insights.sbomify.com/CVE-2023-44430/): Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-4443](https://insights.sbomify.com/CVE-2023-4443/): SourceCodester Free Hospital Management System for Small Practices edit-doc.php sql injection (medium 6.3)
- [CVE-2023-44429](https://insights.sbomify.com/CVE-2023-44429/): GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-44428](https://insights.sbomify.com/CVE-2023-44428/): MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-44427](https://insights.sbomify.com/CVE-2023-44427/): D-Link DIR-X3260 SetSysEmailSettings SMTPServerAddress Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-44426](https://insights.sbomify.com/CVE-2023-44426/): D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-44425](https://insights.sbomify.com/CVE-2023-44425/): D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-44424](https://insights.sbomify.com/CVE-2023-44424/): D-Link DIR-X3260 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-44423](https://insights.sbomify.com/CVE-2023-44423/): D-Link DIR-X3260 SetTriggerPPPoEValidate Password Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-44422](https://insights.sbomify.com/CVE-2023-44422/): D-Link DIR-X3260 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-44421](https://insights.sbomify.com/CVE-2023-44421/): D-Link DIR-X3260 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-44420](https://insights.sbomify.com/CVE-2023-44420/): D-Link DIR-X3260 prog.cgi Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-4442](https://insights.sbomify.com/CVE-2023-4442/): SourceCodester Free Hospital Management System for Small Practices booking-complete.php sql injection (medium 6.3)
- [CVE-2023-44419](https://insights.sbomify.com/CVE-2023-44419/): D-Link DIR-X3260 Prog.cgi Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-44418](https://insights.sbomify.com/CVE-2023-44418/): D-Link DIR-X3260 Prog.cgi Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/216/