# Vulnerabilities published in 2023


- [CVE-2023-38922](https://insights.sbomify.com/CVE-2023-38922/): Memory corruption in netgear:jwnr2000v2 firmware (high 8.8)
- [CVE-2023-38921](https://insights.sbomify.com/CVE-2023-38921/): Command injection in netgear:wag302v2 firmware (high 8.8)
- [CVE-2023-38920](https://insights.sbomify.com/CVE-2023-38920/): Cross-site scripting in phpgurukul:cyber cafe management system (medium 4.8)
- [CVE-2023-3892](https://insights.sbomify.com/CVE-2023-3892/): Unsafe XML parsing of 3rd party DICOM private tags may lead to XXE (medium 5.6)
- [CVE-2023-38916](https://insights.sbomify.com/CVE-2023-38916/): SQL injection in mohammad-ajazuddin:evotingsystem-php (high 8.8)
- [CVE-2023-38915](https://insights.sbomify.com/CVE-2023-38915/): File upload in wolf18:easyadmin8 (critical 9.8)
- [CVE-2023-38913](https://insights.sbomify.com/CVE-2023-38913/): SQL injection in anirbandutta9:news-buzz (medium 5.3)
- [CVE-2023-38912](https://insights.sbomify.com/CVE-2023-38912/): SQL injection in superstorefinder:php script (critical 9.8)
- [CVE-2023-38911](https://insights.sbomify.com/CVE-2023-38911/): Cross-site scripting in cszcms:csz cms (medium 5.4)
- [CVE-2023-38910](https://insights.sbomify.com/CVE-2023-38910/): Cross-site scripting in cszcms:csz cms (medium 6.1)
- [CVE-2023-3891](https://insights.sbomify.com/CVE-2023-3891/): Lapce v0.2.8 - Privilege escalation via Race Condition (high 7.3)
- [CVE-2023-38909](https://insights.sbomify.com/CVE-2023-38909/): Weak cryptography in tp-link:tapo (medium 6.5)
- [CVE-2023-38908](https://insights.sbomify.com/CVE-2023-38908/): Information disclosure in tp-link:tapo (medium 6.5)
- [CVE-2023-38907](https://insights.sbomify.com/CVE-2023-38907/): Weak cryptography in tp-link:tapo (high 7.5)
- [CVE-2023-38906](https://insights.sbomify.com/CVE-2023-38906/): Information disclosure in tp-link:tapo (medium 6.5)
- [CVE-2023-38905](https://insights.sbomify.com/CVE-2023-38905/): Jeecg-boot SQL Injection vulnerability (medium 5.5)
- [CVE-2023-38904](https://insights.sbomify.com/CVE-2023-38904/): Cross-site scripting in decapcms:netlify cms (medium 5.4)
- [CVE-2023-38902](https://insights.sbomify.com/CVE-2023-38902/): Command injection in ruijie:rg-eap101 firmware (high 8.8)
- [CVE-2023-3890](https://insights.sbomify.com/CVE-2023-3890/): Campcodes Beauty Salon Management System edit-accepted-appointment.php cross site scripting (low 3.5)
- [CVE-2023-38899](https://insights.sbomify.com/CVE-2023-38899/): SQL injection in berkaygediz:o blog (high 7.8)
- [CVE-2023-38898](https://insights.sbomify.com/CVE-2023-38898/): Information disclosure in python:python (medium 5.3)
- [CVE-2023-38896](https://insights.sbomify.com/CVE-2023-38896/): LangChain vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-38894](https://insights.sbomify.com/CVE-2023-38894/): tree-kit Prototype Pollution vulnerability (critical 9.8)
- [CVE-2023-38891](https://insights.sbomify.com/CVE-2023-38891/): SQL injection in vtiger:vtiger crm (high 8.8)
- [CVE-2023-38890](https://insights.sbomify.com/CVE-2023-38890/): SQL injection in phpgurukul:online shopping portal (high 8.8)
- [CVE-2023-3889](https://insights.sbomify.com/CVE-2023-3889/): Mali GPU Kernel Driver exposes sensitive data from freed memory (high 7.8)
- [CVE-2023-38889](https://insights.sbomify.com/CVE-2023-38889/): Alluxio vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-38888](https://insights.sbomify.com/CVE-2023-38888/): Cross Site Scripting vulnerability in Dolibarr ERP CRM (critical 9.6)
- [CVE-2023-38887](https://insights.sbomify.com/CVE-2023-38887/): File Upload vulnerability in Dolibarr ERP CRM (high 8.8)
- [CVE-2023-38886](https://insights.sbomify.com/CVE-2023-38886/): Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script (high 7.2)
- [CVE-2023-38885](https://insights.sbomify.com/CVE-2023-38885/): Cross-site request forgery in os4ed:opensis (high 8.8)
- [CVE-2023-38884](https://insights.sbomify.com/CVE-2023-38884/): Missing authorization in os4ed:opensis (high 7.5)
- [CVE-2023-38883](https://insights.sbomify.com/CVE-2023-38883/): Cross-site scripting in os4ed:opensis (medium 6.1)
- [CVE-2023-38882](https://insights.sbomify.com/CVE-2023-38882/): Cross-site scripting in os4ed:opensis (medium 6.1)
- [CVE-2023-38881](https://insights.sbomify.com/CVE-2023-38881/): Cross-site scripting in os4ed:opensis (medium 6.1)
- [CVE-2023-38880](https://insights.sbomify.com/CVE-2023-38880/): Information disclosure in os4ed:opensis (critical 9.8)
- [CVE-2023-3888](https://insights.sbomify.com/CVE-2023-3888/): Campcodes Beauty Salon Management System admin-profile.php cross site scripting (low 3.5)
- [CVE-2023-38879](https://insights.sbomify.com/CVE-2023-38879/): Path traversal in os4ed:opensis (high 7.5)
- [CVE-2023-38878](https://insights.sbomify.com/CVE-2023-38878/): Cross-site scripting in devcode:openstamanager (medium 6.1)
- [CVE-2023-38877](https://insights.sbomify.com/CVE-2023-38877/): Economizzer host header injection vulnerability (high 8.8)
- [CVE-2023-38876](https://insights.sbomify.com/CVE-2023-38876/): Cross-site scripting in msaad1999:php-login-system (medium 6.1)
- [CVE-2023-38875](https://insights.sbomify.com/CVE-2023-38875/): Cross-site scripting in msaad1999:php-login-system (medium 6.1)
- [CVE-2023-38874](https://insights.sbomify.com/CVE-2023-38874/): Economizzer remote code execution vulnerability (high 8.8)
- [CVE-2023-38873](https://insights.sbomify.com/CVE-2023-38873/): Economizzer vulnerable to Clickjacking (medium 6.5)
- [CVE-2023-38872](https://insights.sbomify.com/CVE-2023-38872/): Economizzer Insecure Direct Object Reference vulnerability (low 3.7)
- [CVE-2023-38871](https://insights.sbomify.com/CVE-2023-38871/): Economizzer user enumeration vulnerability (medium 5.3)
- [CVE-2023-38870](https://insights.sbomify.com/CVE-2023-38870/): SQL injection in economizzer:economizzer (critical 9.8)
- [CVE-2023-3887](https://insights.sbomify.com/CVE-2023-3887/): Campcodes Beauty Salon Management System search-appointment.php cross site scripting (low 3.5)
- [CVE-2023-38866](https://insights.sbomify.com/CVE-2023-38866/): Command injection in comfast:cf-xr11 firmware (critical 9.8)
- [CVE-2023-38865](https://insights.sbomify.com/CVE-2023-38865/): Command injection in comfast:cf-xr11 firmware (critical 9.8)
- [CVE-2023-38864](https://insights.sbomify.com/CVE-2023-38864/): Command injection in comfast:cf-xr11 firmware (critical 9.8)
- [CVE-2023-38863](https://insights.sbomify.com/CVE-2023-38863/): Command injection in comfast:cf-xr11 firmware (critical 9.8)
- [CVE-2023-38862](https://insights.sbomify.com/CVE-2023-38862/): Command injection in comfast:cf-xr11 firmware (critical 9.8)
- [CVE-2023-38861](https://insights.sbomify.com/CVE-2023-38861/): Command injection in wavlink:wl-wn575a3 firmware (critical 9.8)
- [CVE-2023-38860](https://insights.sbomify.com/CVE-2023-38860/): LangChain vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-3886](https://insights.sbomify.com/CVE-2023-3886/): Campcodes Beauty Salon Management System invoice.php cross site scripting (low 3.5)
- [CVE-2023-38858](https://insights.sbomify.com/CVE-2023-38858/): Memory corruption in faad2 project:faad2 (medium 6.5)
- [CVE-2023-38857](https://insights.sbomify.com/CVE-2023-38857/): Memory corruption in faad2 project:faad2 (medium 5.5)
- [CVE-2023-38856](https://insights.sbomify.com/CVE-2023-38856/): Memory corruption in libxls project:libxls (medium 6.5)
- [CVE-2023-38855](https://insights.sbomify.com/CVE-2023-38855/): Memory corruption in libxls project:libxls (medium 6.5)
- [CVE-2023-38854](https://insights.sbomify.com/CVE-2023-38854/): Memory corruption in libxls project:libxls (medium 6.5)
- [CVE-2023-38853](https://insights.sbomify.com/CVE-2023-38853/): Memory corruption in libxls project:libxls (medium 6.5)
- [CVE-2023-38852](https://insights.sbomify.com/CVE-2023-38852/): Memory corruption in libxls project:libxls (medium 6.5)
- [CVE-2023-38851](https://insights.sbomify.com/CVE-2023-38851/): Memory corruption in libxls project:libxls (medium 6.5)
- [CVE-2023-38850](https://insights.sbomify.com/CVE-2023-38850/): Memory corruption in msweet:codedoc (medium 5.5)
- [CVE-2023-3885](https://insights.sbomify.com/CVE-2023-3885/): Campcodes Beauty Salon Management System edit_category.php cross site scripting (low 3.5)
- [CVE-2023-38849](https://insights.sbomify.com/CVE-2023-38849/): Information disclosure in linecorp:line (high 7.5)
- [CVE-2023-38848](https://insights.sbomify.com/CVE-2023-38848/): Information disclosure in linecorp:line (high 7.5)
- [CVE-2023-38847](https://insights.sbomify.com/CVE-2023-38847/): Information disclosure in linecorp:line (high 7.5)
- [CVE-2023-38846](https://insights.sbomify.com/CVE-2023-38846/): Information disclosure in linecorp:line (high 7.5)
- [CVE-2023-38845](https://insights.sbomify.com/CVE-2023-38845/): Information disclosure in linecorp:line (high 7.5)
- [CVE-2023-38844](https://insights.sbomify.com/CVE-2023-38844/): SQL injection in sigb:pmb (high 7.5)
- [CVE-2023-38843](https://insights.sbomify.com/CVE-2023-38843/): Code injection in atlos:atlos (high 8.0)
- [CVE-2023-38840](https://insights.sbomify.com/CVE-2023-38840/): Information disclosure in bitwarden:bitwarden (medium 5.5)
- [CVE-2023-3884](https://insights.sbomify.com/CVE-2023-3884/): Campcodes Beauty Salon Management System edit_product.php cross site scripting (low 3.5)
- [CVE-2023-38839](https://insights.sbomify.com/CVE-2023-38839/): SQL injection in kidus:minimati (high 7.5)
- [CVE-2023-38838](https://insights.sbomify.com/CVE-2023-38838/): SQL injection in kiduswb:minimati (high 7.5)
- [CVE-2023-38836](https://insights.sbomify.com/CVE-2023-38836/): File upload in boidcms:boidcms (high 8.8)
- [CVE-2023-38831](https://insights.sbomify.com/CVE-2023-38831/): RARLAB WinRAR Code Execution (high 7.8, exploited in the wild)
- [CVE-2023-38830](https://insights.sbomify.com/CVE-2023-38830/): Information disclosure in phpjabbers:yacht listing script (high 7.5)
- [CVE-2023-3883](https://insights.sbomify.com/CVE-2023-3883/): Campcodes Beauty Salon Management System add-category.php cross site scripting (low 3.5)
- [CVE-2023-38829](https://insights.sbomify.com/CVE-2023-38829/): Command injection in netis-systems:wf2409e firmware (high 8.8)
- [CVE-2023-38827](https://insights.sbomify.com/CVE-2023-38827/): Cross-site scripting in follettlearning:solutions destiny (medium 6.1)
- [CVE-2023-38826](https://insights.sbomify.com/CVE-2023-38826/): Cross-site scripting in follettlearning:solutions destiny (medium 6.1)
- [CVE-2023-38825](https://insights.sbomify.com/CVE-2023-38825/): SQL injection in vanderbilt:redcap (critical 9.8)
- [CVE-2023-38823](https://insights.sbomify.com/CVE-2023-38823/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-3882](https://insights.sbomify.com/CVE-2023-3882/): Campcodes Beauty Salon Management System edit-accepted-appointment.php sql injection (medium 6.3)
- [CVE-2023-38817](https://insights.sbomify.com/CVE-2023-38817/): Privilege escalation in echo:anti cheat tool (high 7.8)
- [CVE-2023-3881](https://insights.sbomify.com/CVE-2023-3881/): Campcodes Beauty Salon Management System forgot-password.php sql injection (medium 6.3)
- [CVE-2023-38802](https://insights.sbomify.com/CVE-2023-38802/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2023-3880](https://insights.sbomify.com/CVE-2023-3880/): Campcodes Beauty Salon Management System del_service.php sql injection (medium 6.3)
- [CVE-2023-3879](https://insights.sbomify.com/CVE-2023-3879/): Campcodes Beauty Salon Management System del_category.php sql injection (medium 6.3)
- [CVE-2023-3878](https://insights.sbomify.com/CVE-2023-3878/): Campcodes Beauty Salon Management System about-us.php sql injection (medium 6.3)
- [CVE-2023-38773](https://insights.sbomify.com/CVE-2023-38773/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-38771](https://insights.sbomify.com/CVE-2023-38771/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-38770](https://insights.sbomify.com/CVE-2023-38770/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-3877](https://insights.sbomify.com/CVE-2023-3877/): Campcodes Beauty Salon Management System add-services.php sql injection (medium 6.3)
- [CVE-2023-38769](https://insights.sbomify.com/CVE-2023-38769/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-38768](https://insights.sbomify.com/CVE-2023-38768/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-38767](https://insights.sbomify.com/CVE-2023-38767/): SQL injection in churchcrm:churchcrm (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/259/