# Vulnerabilities published in 2023


- [CVE-2023-41855](https://insights.sbomify.com/CVE-2023-41855/): WordPress Regpack Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41854](https://insights.sbomify.com/CVE-2023-41854/): WordPress wpCentral Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-41853](https://insights.sbomify.com/CVE-2023-41853/): WordPress WP iCal Availability Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41852](https://insights.sbomify.com/CVE-2023-41852/): WordPress MailMunch – Grow your Email List Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41851](https://insights.sbomify.com/CVE-2023-41851/): WordPress WP Custom Post Template Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41850](https://insights.sbomify.com/CVE-2023-41850/): WordPress Outbound Link Manager Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4185](https://insights.sbomify.com/CVE-2023-4185/): SourceCodester Online Hospital Management System patientlogin.php sql injection (medium 6.3)
- [CVE-2023-41849](https://insights.sbomify.com/CVE-2023-41849/): WordPress Posts Like Dislike plugin <= 1.1.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-41848](https://insights.sbomify.com/CVE-2023-41848/): WordPress Carousel Slider plugin <= 2.2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-41847](https://insights.sbomify.com/CVE-2023-41847/): WordPress Notice Bar Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-41846](https://insights.sbomify.com/CVE-2023-41846/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-41844](https://insights.sbomify.com/CVE-2023-41844/): Cross-site scripting in FortiSandbox (low 3.4)
- [CVE-2023-41843](https://insights.sbomify.com/CVE-2023-41843/): Cross-site scripting in FortiSandbox (high 7.3)
- [CVE-2023-41842](https://insights.sbomify.com/CVE-2023-41842/): Memory corruption in FortiAnalyzer (medium 6.3)
- [CVE-2023-41841](https://insights.sbomify.com/CVE-2023-41841/): Privilege escalation in FortiOS (high 7.4)
- [CVE-2023-41840](https://insights.sbomify.com/CVE-2023-41840/): Other in FortiClientWindows (high 7.4)
- [CVE-2023-4184](https://insights.sbomify.com/CVE-2023-4184/): SourceCodester Inventory Management System sell_return.php sql injection (high 7.3)
- [CVE-2023-41838](https://insights.sbomify.com/CVE-2023-41838/): Command injection in FortiAnalyzer (medium 6.9)
- [CVE-2023-41836](https://insights.sbomify.com/CVE-2023-41836/): Cross-site scripting in FortiSandbox (low 3.4)
- [CVE-2023-41835](https://insights.sbomify.com/CVE-2023-41835/): Apache Struts: excessive disk usage (high 7.5)
- [CVE-2023-41834](https://insights.sbomify.com/CVE-2023-41834/): Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences (medium 6.1)
- [CVE-2023-41833](https://insights.sbomify.com/CVE-2023-41833/): Race condition in UEFI firmware for some Intel(R) processors (high 8.7)
- [CVE-2023-41830](https://insights.sbomify.com/CVE-2023-41830/): Path traversal in Phones (medium 6.5)
- [CVE-2023-4183](https://insights.sbomify.com/CVE-2023-4183/): SourceCodester Inventory Management System Password edit_update.php access control (medium 4.3)
- [CVE-2023-41829](https://insights.sbomify.com/CVE-2023-41829/): Missing authorization in Phones (medium 5.0)
- [CVE-2023-41828](https://insights.sbomify.com/CVE-2023-41828/): Missing authorization in Phones (medium 4.4)
- [CVE-2023-41827](https://insights.sbomify.com/CVE-2023-41827/): Missing authorization in Phones (medium 5.1)
- [CVE-2023-41826](https://insights.sbomify.com/CVE-2023-41826/): Other in Phones (medium 5.1)
- [CVE-2023-41825](https://insights.sbomify.com/CVE-2023-41825/): Path traversal in Phones (low 2.8)
- [CVE-2023-41824](https://insights.sbomify.com/CVE-2023-41824/): Information disclosure in Phones (low 2.8)
- [CVE-2023-41823](https://insights.sbomify.com/CVE-2023-41823/): Missing authorization in Phones (medium 4.4)
- [CVE-2023-41822](https://insights.sbomify.com/CVE-2023-41822/): Missing authorization in Phones (medium 4.8)
- [CVE-2023-41821](https://insights.sbomify.com/CVE-2023-41821/): Information disclosure in Phones (medium 5.0)
- [CVE-2023-41820](https://insights.sbomify.com/CVE-2023-41820/): Information disclosure in Phones (medium 5.0)
- [CVE-2023-4182](https://insights.sbomify.com/CVE-2023-4182/): SourceCodester Inventory Management System edit_sell.php sql injection (high 7.3)
- [CVE-2023-41819](https://insights.sbomify.com/CVE-2023-41819/): Missing authorization in Phones (medium 6.1)
- [CVE-2023-41818](https://insights.sbomify.com/CVE-2023-41818/): Information disclosure in Phones (medium 5.0)
- [CVE-2023-41817](https://insights.sbomify.com/CVE-2023-41817/): Information disclosure in Phones (low 2.8)
- [CVE-2023-41816](https://insights.sbomify.com/CVE-2023-41816/): Missing authorization in Phones (medium 5.0)
- [CVE-2023-41815](https://insights.sbomify.com/CVE-2023-41815/): XSS in File manager (high 7.5)
- [CVE-2023-41814](https://insights.sbomify.com/CVE-2023-41814/): XSS Vulnerability Messages (low 3.7)
- [CVE-2023-41813](https://insights.sbomify.com/CVE-2023-41813/): User notification settings edition (low 3.0)
- [CVE-2023-41812](https://insights.sbomify.com/CVE-2023-41812/): Uploading executables via the file manager (medium 5.7)
- [CVE-2023-41811](https://insights.sbomify.com/CVE-2023-41811/): Stored XSS Via Site News Page (medium 5.3)
- [CVE-2023-41810](https://insights.sbomify.com/CVE-2023-41810/): Stored XSS Via Dashboard Panel (medium 4.0)
- [CVE-2023-4181](https://insights.sbomify.com/CVE-2023-4181/): SourceCodester Free Hospital Management System for Small Practices Redirect behavioral workflow (medium 5.4)
- [CVE-2023-41808](https://insights.sbomify.com/CVE-2023-41808/): Arbitrary File Read As Root Via GoTTY Page (high 8.5)
- [CVE-2023-41807](https://insights.sbomify.com/CVE-2023-41807/): Linux Local Privilege Escalation Via GoTTY Page (critical 9.1)
- [CVE-2023-41806](https://insights.sbomify.com/CVE-2023-41806/): Misassignment of privileges can cause DOS attack (high 8.2)
- [CVE-2023-41805](https://insights.sbomify.com/CVE-2023-41805/): Broken Access Control vulnerability in multiple Brainstorm Force plugins (medium 6.5)
- [CVE-2023-41804](https://insights.sbomify.com/CVE-2023-41804/): WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF) (high 7.1)
- [CVE-2023-41803](https://insights.sbomify.com/CVE-2023-41803/): WordPress BitPay Checkout for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-41802](https://insights.sbomify.com/CVE-2023-41802/): WordPress Super Socializer plugin <= 7.13.54 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41801](https://insights.sbomify.com/CVE-2023-41801/): WordPress AWP Classifieds Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-41800](https://insights.sbomify.com/CVE-2023-41800/): WordPress UniConsent Cookie Consent CMP for GDPR / CCPA Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4180](https://insights.sbomify.com/CVE-2023-4180/): SourceCodester Free Hospital Management System for Small Practices login.php sql injection (high 7.3)
- [CVE-2023-41798](https://insights.sbomify.com/CVE-2023-41798/): WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection (medium 5.1)
- [CVE-2023-41797](https://insights.sbomify.com/CVE-2023-41797/): WordPress Locations Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-41796](https://insights.sbomify.com/CVE-2023-41796/): WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR) (medium 5.3)
- [CVE-2023-41793](https://insights.sbomify.com/CVE-2023-41793/): Path Traversal and Untrusted Upload File (medium 6.7)
- [CVE-2023-41792](https://insights.sbomify.com/CVE-2023-41792/): Lack of Authorization and Stored XSS Via SNMP Trap Editor Page (medium 5.9)
- [CVE-2023-41791](https://insights.sbomify.com/CVE-2023-41791/): Lack of Authorization and Stored XSS Via Translation Abuse (high 8.4)
- [CVE-2023-41790](https://insights.sbomify.com/CVE-2023-41790/): Traversal Path on PHP file (high 7.6)
- [CVE-2023-4179](https://insights.sbomify.com/CVE-2023-4179/): SourceCodester Free Hospital Management System for Small Practices sql injection (medium 6.3)
- [CVE-2023-41789](https://insights.sbomify.com/CVE-2023-41789/): Unauthenticated Admin Account Takeover Via XSS (high 7.6)
- [CVE-2023-41788](https://insights.sbomify.com/CVE-2023-41788/): Remote Code Execution via File Uploader (high 7.6)
- [CVE-2023-41787](https://insights.sbomify.com/CVE-2023-41787/): Arbitrary File Read (medium 6.0)
- [CVE-2023-41786](https://insights.sbomify.com/CVE-2023-41786/): Database backups availability by low-privileged users (medium 6.8)
- [CVE-2023-41784](https://insights.sbomify.com/CVE-2023-41784/): Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro (medium 6.6)
- [CVE-2023-41783](https://insights.sbomify.com/CVE-2023-41783/): Command Injection Vulnerability of ZTE's ZXCLOUD iRAI (medium 4.3)
- [CVE-2023-41782](https://insights.sbomify.com/CVE-2023-41782/): DLL Hijacking Vulnerability in ZTE ZXCLOUD iRAI (low 3.9)
- [CVE-2023-41781](https://insights.sbomify.com/CVE-2023-41781/): XSS Vulnerability in ZTE MF258 Products (medium 5.7)
- [CVE-2023-41780](https://insights.sbomify.com/CVE-2023-41780/): Unsafe DLL Loading Vulnerability in ZTE ZXCLOUD iRAI (medium 6.4)
- [CVE-2023-4178](https://insights.sbomify.com/CVE-2023-4178/): Authentication Bypass in Neutron Smart VMS (critical 9.8)
- [CVE-2023-41779](https://insights.sbomify.com/CVE-2023-41779/): Illegal Memory Access Vulnerability of ZTE's ZXCLOUD iRAI (medium 4.4)
- [CVE-2023-41776](https://insights.sbomify.com/CVE-2023-41776/): Local Privilege Escalation Vulnerability of ZTE's ZXCLOUD iRAI (medium 6.7)
- [CVE-2023-41775](https://insights.sbomify.com/CVE-2023-41775/): Security feature bypass in 'direct' Desktop App for macOS (medium 5.5)
- [CVE-2023-41774](https://insights.sbomify.com/CVE-2023-41774/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-41773](https://insights.sbomify.com/CVE-2023-41773/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-41772](https://insights.sbomify.com/CVE-2023-41772/): Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-41771](https://insights.sbomify.com/CVE-2023-41771/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-41770](https://insights.sbomify.com/CVE-2023-41770/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-4177](https://insights.sbomify.com/CVE-2023-4177/): EmpowerID Multi-Factor Authentication Code information disclosure (low 2.6)
- [CVE-2023-41769](https://insights.sbomify.com/CVE-2023-41769/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-41768](https://insights.sbomify.com/CVE-2023-41768/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-41767](https://insights.sbomify.com/CVE-2023-41767/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-41766](https://insights.sbomify.com/CVE-2023-41766/): Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-41765](https://insights.sbomify.com/CVE-2023-41765/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-41764](https://insights.sbomify.com/CVE-2023-41764/): Microsoft Office Spoofing Vulnerability (medium 5.5)
- [CVE-2023-41763](https://insights.sbomify.com/CVE-2023-41763/): Microsoft Skype for Business Privilege Escalation (medium 5.3, exploited in the wild)
- [CVE-2023-4176](https://insights.sbomify.com/CVE-2023-4176/): SourceCodester Hospital Management System appointmentapproval.php sql injection (medium 6.3)
- [CVE-2023-41752](https://insights.sbomify.com/CVE-2023-41752/): Apache Traffic Server: s3_auth plugin problem with hash calculation (high 7.5)
- [CVE-2023-41751](https://insights.sbomify.com/CVE-2023-41751/): Auth bypass in Acronis Agent (medium 6.3)
- [CVE-2023-41750](https://insights.sbomify.com/CVE-2023-41750/): Missing authorization in Acronis Agent (low 3.3)
- [CVE-2023-4175](https://insights.sbomify.com/CVE-2023-4175/): mooSocial mooTravel cross site scripting (low 3.5)
- [CVE-2023-41749](https://insights.sbomify.com/CVE-2023-41749/): Information disclosure in Acronis Agent (medium 4.4)
- [CVE-2023-41748](https://insights.sbomify.com/CVE-2023-41748/): Command injection in Acronis Cloud Manager (high 8.0)
- [CVE-2023-41747](https://insights.sbomify.com/CVE-2023-41747/): Path traversal in Acronis Cloud Manager (medium 6.5)
- [CVE-2023-41746](https://insights.sbomify.com/CVE-2023-41746/): Command injection in Acronis Cloud Manager (high 8.0)
- [CVE-2023-41745](https://insights.sbomify.com/CVE-2023-41745/): Information disclosure in Acronis Agent (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/236/