# Vulnerabilities published in 2023


- [CVE-2023-41744](https://insights.sbomify.com/CVE-2023-41744/): Privilege escalation in Acronis Agent (high 7.8)
- [CVE-2023-41743](https://insights.sbomify.com/CVE-2023-41743/): Privilege escalation in Acronis Cyber Protect 15 (high 8.8)
- [CVE-2023-41742](https://insights.sbomify.com/CVE-2023-41742/): Misconfiguration in Acronis Agent (medium 4.3)
- [CVE-2023-41741](https://insights.sbomify.com/CVE-2023-41741/): Information disclosure in Synology Router Manager (SRM) (medium 5.3)
- [CVE-2023-41740](https://insights.sbomify.com/CVE-2023-41740/): Path traversal in Synology Router Manager (SRM) (medium 5.3)
- [CVE-2023-4174](https://insights.sbomify.com/CVE-2023-4174/): mooSocial mooStore cross site scripting (low 3.5)
- [CVE-2023-41739](https://insights.sbomify.com/CVE-2023-41739/): Denial of service in Synology Router Manager (SRM) (medium 4.9)
- [CVE-2023-41738](https://insights.sbomify.com/CVE-2023-41738/): Command injection in Synology Router Manager (SRM) (high 7.2)
- [CVE-2023-41737](https://insights.sbomify.com/CVE-2023-41737/): WordPress Swifty Bar, sticky bar by WPGens Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41736](https://insights.sbomify.com/CVE-2023-41736/): WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41735](https://insights.sbomify.com/CVE-2023-41735/): WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-41734](https://insights.sbomify.com/CVE-2023-41734/): WordPress Insert Estimated Reading Time Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41733](https://insights.sbomify.com/CVE-2023-41733/): WordPress Back To The Top Button Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41732](https://insights.sbomify.com/CVE-2023-41732/): WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-41731](https://insights.sbomify.com/CVE-2023-41731/): WordPress wordpress publish post email notification Plugin <= 1.0.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41730](https://insights.sbomify.com/CVE-2023-41730/): WordPress SendPress Newsletters Plugin <= 1.22.3.31 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4173](https://insights.sbomify.com/CVE-2023-4173/): mooSocial mooStore index cross site scripting (low 3.5)
- [CVE-2023-41729](https://insights.sbomify.com/CVE-2023-41729/): WordPress SendPress Newsletters Plugin <= 1.22.3.31 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41728](https://insights.sbomify.com/CVE-2023-41728/): WordPress Rescue Shortcodes Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-41727](https://insights.sbomify.com/CVE-2023-41727/): Memory corruption in Wavelink (critical 9.8)
- [CVE-2023-41726](https://insights.sbomify.com/CVE-2023-41726/): Misconfiguration in Avalanche (high 7.8)
- [CVE-2023-41725](https://insights.sbomify.com/CVE-2023-41725/): File upload in Avalanche (high 7.8)
- [CVE-2023-41724](https://insights.sbomify.com/CVE-2023-41724/): Command injection in Sentry (critical 9.6)
- [CVE-2023-41723](https://insights.sbomify.com/CVE-2023-41723/): Missing authorization in One (medium 4.3)
- [CVE-2023-41721](https://insights.sbomify.com/CVE-2023-41721/): Missing authorization in UniFi Network Application (critical 10.0)
- [CVE-2023-41720](https://insights.sbomify.com/CVE-2023-41720/): Privilege escalation in Connect Secure (high 7.0)
- [CVE-2023-4172](https://insights.sbomify.com/CVE-2023-4172/): Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx absolute path traversal (medium 4.3)
- [CVE-2023-41719](https://insights.sbomify.com/CVE-2023-41719/): Other in Connect Secure (high 7.2)
- [CVE-2023-41718](https://insights.sbomify.com/CVE-2023-41718/): Privilege escalation in Secure Access (high 7.8)
- [CVE-2023-41717](https://insights.sbomify.com/CVE-2023-41717/): Security feature bypass in zscaler:zscaler proxy (medium 5.5)
- [CVE-2023-41715](https://insights.sbomify.com/CVE-2023-41715/): Privilege escalation in SonicOS (high 8.8)
- [CVE-2023-41713](https://insights.sbomify.com/CVE-2023-41713/): Hardcoded credentials in SonicOS (high 7.5)
- [CVE-2023-41712](https://insights.sbomify.com/CVE-2023-41712/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2023-41711](https://insights.sbomify.com/CVE-2023-41711/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2023-41710](https://insights.sbomify.com/CVE-2023-41710/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-4171](https://insights.sbomify.com/CVE-2023-4171/): Chengdu Flash Flood Disaster Monitoring and Warning System FileDownload.ashx path traversal (medium 4.3)
- [CVE-2023-41708](https://insights.sbomify.com/CVE-2023-41708/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-41707](https://insights.sbomify.com/CVE-2023-41707/): Denial of service in OX App Suite (medium 6.5)
- [CVE-2023-41706](https://insights.sbomify.com/CVE-2023-41706/): Denial of service in OX App Suite (medium 6.5)
- [CVE-2023-41705](https://insights.sbomify.com/CVE-2023-41705/): Denial of service in OX App Suite (medium 6.5)
- [CVE-2023-41704](https://insights.sbomify.com/CVE-2023-41704/): Cross-site scripting in OX App Suite (high 7.1)
- [CVE-2023-41703](https://insights.sbomify.com/CVE-2023-41703/): Cross-site scripting in OX App Suite (medium 6.1)
- [CVE-2023-4170](https://insights.sbomify.com/CVE-2023-4170/): DedeBIZ Article cross site scripting (low 3.5)
- [CVE-2023-41699](https://insights.sbomify.com/CVE-2023-41699/): Payara Platform: URL Redirection to untrusted site using FORM authentication (medium 6.1)
- [CVE-2023-41697](https://insights.sbomify.com/CVE-2023-41697/): WordPress Easy WP Cleaner Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41695](https://insights.sbomify.com/CVE-2023-41695/): WordPress Analytify plugin <= 5.1.0 - Broken Access Control vulnerability (low 3.5)
- [CVE-2023-41694](https://insights.sbomify.com/CVE-2023-41694/): WordPress Realbig Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41693](https://insights.sbomify.com/CVE-2023-41693/): WordPress MyCryptoCheckout Plugin <= 2.125 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-41692](https://insights.sbomify.com/CVE-2023-41692/): WordPress Attorney Theme <= 3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41691](https://insights.sbomify.com/CVE-2023-41691/): WordPress WooCommerce PensoPay Plugin <= 6.3.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41690](https://insights.sbomify.com/CVE-2023-41690/): WordPress WiserNotify Social Proof plugin <= 2.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-4169](https://insights.sbomify.com/CVE-2023-4169/): Ruijie RG-EW1200G Administrator Password set_passwd access control (medium 6.3)
- [CVE-2023-41689](https://insights.sbomify.com/CVE-2023-41689/): WordPress Post to Google My Business (Google Business Profile) plugin <= 3.1.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41688](https://insights.sbomify.com/CVE-2023-41688/): WordPress Bulk NoIndex & NoFollow Toolkit plugin <= 1.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-41687](https://insights.sbomify.com/CVE-2023-41687/): WordPress Goods Catalog Plugin <= 2.4.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-41686](https://insights.sbomify.com/CVE-2023-41686/): WordPress Woocommerce Support System plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2023-41685](https://insights.sbomify.com/CVE-2023-41685/): WordPress Woocommerce Support System Plugin <= 1.2.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-41684](https://insights.sbomify.com/CVE-2023-41684/): WordPress SIS Handball Plugin <= 1.0.45 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41683](https://insights.sbomify.com/CVE-2023-41683/): WordPress TelSender plugin <= 1.14.11 - Broken Access Control + CSRF vulnerability (medium 5.4)
- [CVE-2023-41682](https://insights.sbomify.com/CVE-2023-41682/): Path traversal in FortiSandbox (high 7.9)
- [CVE-2023-41681](https://insights.sbomify.com/CVE-2023-41681/): Cross-site scripting in FortiSandbox (high 7.3)
- [CVE-2023-41680](https://insights.sbomify.com/CVE-2023-41680/): Cross-site scripting in FortiSandbox (high 7.3)
- [CVE-2023-4168](https://insights.sbomify.com/CVE-2023-4168/): Templatecookie Adlisting Redirect ad-list information disclosure (medium 4.3)
- [CVE-2023-41679](https://insights.sbomify.com/CVE-2023-41679/): Missing authorization in FortiManager (high 7.7)
- [CVE-2023-41678](https://insights.sbomify.com/CVE-2023-41678/): Memory corruption in FortiOS (high 8.3)
- [CVE-2023-41677](https://insights.sbomify.com/CVE-2023-41677/): Information disclosure in FortiOS (high 7.5)
- [CVE-2023-41676](https://insights.sbomify.com/CVE-2023-41676/): Information disclosure in FortiSIEM (medium 4.2)
- [CVE-2023-41675](https://insights.sbomify.com/CVE-2023-41675/): Use after free in FortiOS (medium 4.8)
- [CVE-2023-41673](https://insights.sbomify.com/CVE-2023-41673/): Missing authorization in FortiADC (medium 6.9)
- [CVE-2023-41672](https://insights.sbomify.com/CVE-2023-41672/): Cross-site request forgery in Hide admin notices – Admin Notification Center (medium 4.3)
- [CVE-2023-41671](https://insights.sbomify.com/CVE-2023-41671/): WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.16.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-41670](https://insights.sbomify.com/CVE-2023-41670/): WordPress Use Memcached Plugin <= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-4167](https://insights.sbomify.com/CVE-2023-4167/): Media Browser Emby Server cross site scripting (low 3.5)
- [CVE-2023-41669](https://insights.sbomify.com/CVE-2023-41669/): WordPress Live News Plugin <= 1.06 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41668](https://insights.sbomify.com/CVE-2023-41668/): WordPress Leadster Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-41667](https://insights.sbomify.com/CVE-2023-41667/): WordPress WP-dTree Plugin <= 4.4.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41666](https://insights.sbomify.com/CVE-2023-41666/): WordPress Stock Quotes List Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-41665](https://insights.sbomify.com/CVE-2023-41665/): WordPress GiveWP plugin <= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-41664](https://insights.sbomify.com/CVE-2023-41664/): WordPress Easy Newsletter Signups plugin <= 1.0.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-41663](https://insights.sbomify.com/CVE-2023-41663/): WordPress WP Bannerize Pro Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41662](https://insights.sbomify.com/CVE-2023-41662/): WordPress WP-dTree Plugin <= 4.4.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41661](https://insights.sbomify.com/CVE-2023-41661/): WordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41660](https://insights.sbomify.com/CVE-2023-41660/): Cross-site request forgery in WP Synchro (medium 6.5)
- [CVE-2023-4166](https://insights.sbomify.com/CVE-2023-4166/): Tongda OA delete_log.php sql injection (medium 5.5)
- [CVE-2023-41659](https://insights.sbomify.com/CVE-2023-41659/): WordPress Responsive Gallery Grid Plugin <= 2.3.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-41658](https://insights.sbomify.com/CVE-2023-41658/): WordPress Photo Gallery Slideshow & Masonry Tiled Gallery Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41657](https://insights.sbomify.com/CVE-2023-41657/): WordPress HollerBox Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41656](https://insights.sbomify.com/CVE-2023-41656/): WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-41655](https://insights.sbomify.com/CVE-2023-41655/): WordPress authLdap Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41654](https://insights.sbomify.com/CVE-2023-41654/): WordPress authLdap Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-41653](https://insights.sbomify.com/CVE-2023-41653/): WordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41652](https://insights.sbomify.com/CVE-2023-41652/): WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL Injection (high 8.2)
- [CVE-2023-41651](https://insights.sbomify.com/CVE-2023-41651/): WordPress Multi-column Tag Map plugin <= 17.0.26 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-41650](https://insights.sbomify.com/CVE-2023-41650/): Cross-site request forgery in Remove/hide Author, Date, Category Like Entry-Meta (medium 4.3)
- [CVE-2023-4165](https://insights.sbomify.com/CVE-2023-4165/): Tongda OA delete_seal.php sql injection (medium 5.5)
- [CVE-2023-41649](https://insights.sbomify.com/CVE-2023-41649/): WordPress Ovic Product Bundle plugin <= 1.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-41648](https://insights.sbomify.com/CVE-2023-41648/): WordPress Login and Logout Redirect Plugin <= 2.0.3 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-41646](https://insights.sbomify.com/CVE-2023-41646/): Buttercup allows attackers to obtain the hash of the master password (medium 5.3)
- [CVE-2023-41642](https://insights.sbomify.com/CVE-2023-41642/): Cross-site scripting in grupposcai:realgimm (medium 6.1)
- [CVE-2023-41640](https://insights.sbomify.com/CVE-2023-41640/): SQL injection in grupposcai:realgimm (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/237/