# Vulnerabilities published in 2023


- [CVE-2023-31853](https://insights.sbomify.com/CVE-2023-31853/): Cross-site scripting in cudy:lt400 firmware (medium 6.1)
- [CVE-2023-31852](https://insights.sbomify.com/CVE-2023-31852/): Cross-site scripting in cudy:lt400 firmware (medium 6.1)
- [CVE-2023-31851](https://insights.sbomify.com/CVE-2023-31851/): Cross-site scripting in cudy:lt400 firmware (medium 6.1)
- [CVE-2023-31848](https://insights.sbomify.com/CVE-2023-31848/): Server-side request forgery in davinci project:davinci (high 8.8)
- [CVE-2023-31847](https://insights.sbomify.com/CVE-2023-31847/): Server-side request forgery in davinci project:davinci (medium 6.5)
- [CVE-2023-31845](https://insights.sbomify.com/CVE-2023-31845/): SQL injection in faculty evaluation system project:faculty evaluation system (high 7.2)
- [CVE-2023-31844](https://insights.sbomify.com/CVE-2023-31844/): SQL injection in faculty evaluation system project:faculty evaluation system (high 7.2)
- [CVE-2023-31843](https://insights.sbomify.com/CVE-2023-31843/): SQL injection in faculty evaluation system project:faculty evaluation system (high 7.2)
- [CVE-2023-31842](https://insights.sbomify.com/CVE-2023-31842/): SQL injection in faculty evaluation system project:faculty evaluation system (high 7.2)
- [CVE-2023-3184](https://insights.sbomify.com/CVE-2023-3184/): SourceCodester Sales Tracker Management System cross site scripting (low 2.4)
- [CVE-2023-3183](https://insights.sbomify.com/CVE-2023-3183/): SourceCodester Performance Indicator System addproduct.php cross site scripting (low 3.5)
- [CVE-2023-31826](https://insights.sbomify.com/CVE-2023-31826/): Command injection in nevado-jms (high 7.8)
- [CVE-2023-31825](https://insights.sbomify.com/CVE-2023-31825/): Information disclosure in inageya:inageya (high 7.5)
- [CVE-2023-31824](https://insights.sbomify.com/CVE-2023-31824/): Information disclosure in dericia:delicia (high 7.5)
- [CVE-2023-31823](https://insights.sbomify.com/CVE-2023-31823/): Information disclosure in marui:marui (high 7.5)
- [CVE-2023-31822](https://insights.sbomify.com/CVE-2023-31822/): Information disclosure in entetsu:entetsu store (high 7.5)
- [CVE-2023-31821](https://insights.sbomify.com/CVE-2023-31821/): Information disclosure in albis:albis (high 7.5)
- [CVE-2023-31820](https://insights.sbomify.com/CVE-2023-31820/): Information disclosure in shizutetsu:shizutetsu store (high 7.5)
- [CVE-2023-3182](https://insights.sbomify.com/CVE-2023-3182/): Membership Plugin - Restrict Content < 3.2.3 - Reflected XSS (medium 6.1)
- [CVE-2023-31819](https://insights.sbomify.com/CVE-2023-31819/): Information disclosure in keisei store:livre (high 7.5)
- [CVE-2023-31818](https://insights.sbomify.com/CVE-2023-31818/): Information disclosure in marukyu:marukyu line (high 7.5)
- [CVE-2023-31816](https://insights.sbomify.com/CVE-2023-31816/): Cross-site scripting in content management system project:content management system (medium 6.5)
- [CVE-2023-31814](https://insights.sbomify.com/CVE-2023-31814/): Path traversal in dlink:dir-300 firmware (critical 9.8)
- [CVE-2023-3181](https://insights.sbomify.com/CVE-2023-3181/): Insecure Permissions in Splashtop Software Updater (high 7.8)
- [CVE-2023-31808](https://insights.sbomify.com/CVE-2023-31808/): Hardcoded credentials in technicolor:tg670 firmware (high 7.2)
- [CVE-2023-31807](https://insights.sbomify.com/CVE-2023-31807/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2023-31806](https://insights.sbomify.com/CVE-2023-31806/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2023-31805](https://insights.sbomify.com/CVE-2023-31805/): Cross-site scripting in chamilo:chamilo lms (medium 4.8)
- [CVE-2023-31804](https://insights.sbomify.com/CVE-2023-31804/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2023-31803](https://insights.sbomify.com/CVE-2023-31803/): Cross-site scripting in chamilo:chamilo lms (medium 4.8)
- [CVE-2023-31802](https://insights.sbomify.com/CVE-2023-31802/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2023-31801](https://insights.sbomify.com/CVE-2023-31801/): Cross-site scripting in chamilo:chamilo lms (medium 6.1)
- [CVE-2023-31800](https://insights.sbomify.com/CVE-2023-31800/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2023-3180](https://insights.sbomify.com/CVE-2023-3180/): Heap buffer overflow in virtio_crypto_sym_op_helper() (medium 6.0)
- [CVE-2023-31799](https://insights.sbomify.com/CVE-2023-31799/): Cross-site scripting in chamilo:chamilo lms (medium 4.8)
- [CVE-2023-31794](https://insights.sbomify.com/CVE-2023-31794/): Denial of service in artifex:mupdf (medium 5.5)
- [CVE-2023-3179](https://insights.sbomify.com/CVE-2023-3179/): POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF (high 8.8)
- [CVE-2023-3178](https://insights.sbomify.com/CVE-2023-3178/): POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF (medium 4.3)
- [CVE-2023-31779](https://insights.sbomify.com/CVE-2023-31779/): Cross-site scripting in wekan project:wekan (medium 5.4)
- [CVE-2023-3177](https://insights.sbomify.com/CVE-2023-3177/): SourceCodester Lost and Found Information System view_inquiry.php sql injection (medium 6.3)
- [CVE-2023-31763](https://insights.sbomify.com/CVE-2023-31763/): Auth bypass in agshome smart alarm project:agshome smart alarm firmware (high 7.5)
- [CVE-2023-31762](https://insights.sbomify.com/CVE-2023-31762/): Auth bypass in mydigoo:dg-hamb firmware (high 7.5)
- [CVE-2023-31761](https://insights.sbomify.com/CVE-2023-31761/): Auth bypass in blitzwolf:bw-is22 firmware (high 7.5)
- [CVE-2023-3176](https://insights.sbomify.com/CVE-2023-3176/): SourceCodester Lost and Found Information System manage_user.php sql injection (medium 6.3)
- [CVE-2023-31759](https://insights.sbomify.com/CVE-2023-31759/): Auth bypass in keruistore:kerui w18 firmware (high 7.5)
- [CVE-2023-31757](https://insights.sbomify.com/CVE-2023-31757/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2023-31756](https://insights.sbomify.com/CVE-2023-31756/): Command injection in tp-link:archer vr1600v firmware (medium 6.7)
- [CVE-2023-31754](https://insights.sbomify.com/CVE-2023-31754/): Cross-site scripting in optimizely:optimizely cms (medium 4.8)
- [CVE-2023-31753](https://insights.sbomify.com/CVE-2023-31753/): SQL injection in endonesia:endonesia (critical 9.8)
- [CVE-2023-31752](https://insights.sbomify.com/CVE-2023-31752/): SQL injection in oretnom23:employee and visitor gate pass logging system (critical 9.8)
- [CVE-2023-3175](https://insights.sbomify.com/CVE-2023-3175/): AI ChatBot < 4.6.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-31748](https://insights.sbomify.com/CVE-2023-31748/): Privilege escalation in wondershare:mobiletrans (high 7.8)
- [CVE-2023-31747](https://insights.sbomify.com/CVE-2023-31747/): Privilege escalation in wondershare:filmora (high 7.8)
- [CVE-2023-31746](https://insights.sbomify.com/CVE-2023-31746/): Command injection in adslr:vw2100 firmware (critical 9.8)
- [CVE-2023-31742](https://insights.sbomify.com/CVE-2023-31742/): Command injection in linksys:wrt54gl firmware (high 7.2)
- [CVE-2023-31741](https://insights.sbomify.com/CVE-2023-31741/): Command injection in linksys:e2000 firmware (high 7.2)
- [CVE-2023-31740](https://insights.sbomify.com/CVE-2023-31740/): Command injection in linksys:e2000 firmware (high 7.2)
- [CVE-2023-3173](https://insights.sbomify.com/CVE-2023-3173/): Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor (critical 9.8)
- [CVE-2023-31729](https://insights.sbomify.com/CVE-2023-31729/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2023-31728](https://insights.sbomify.com/CVE-2023-31728/): Security feature bypass in teltonika-networks:rut240 firmware (high 7.0)
- [CVE-2023-31726](https://insights.sbomify.com/CVE-2023-31726/): Missing authorization in alistgo:alist (high 7.5)
- [CVE-2023-31725](https://insights.sbomify.com/CVE-2023-31725/): Use after free in yasm project:yasm (medium 5.5)
- [CVE-2023-31724](https://insights.sbomify.com/CVE-2023-31724/): Memory corruption in yasm project:yasm (high 7.8)
- [CVE-2023-31723](https://insights.sbomify.com/CVE-2023-31723/): Memory corruption in yasm project:yasm (medium 5.5)
- [CVE-2023-31722](https://insights.sbomify.com/CVE-2023-31722/): Memory corruption in nasm:netwide assembler (high 7.8)
- [CVE-2023-3172](https://insights.sbomify.com/CVE-2023-3172/): Path Traversal in froxlor/froxlor (medium 6.5)
- [CVE-2023-31719](https://insights.sbomify.com/CVE-2023-31719/): FUXA SQL Injection vulnerability (critical 9.8)
- [CVE-2023-31718](https://insights.sbomify.com/CVE-2023-31718/): FUXA local file inclusion vulnerability (high 7.5)
- [CVE-2023-31717](https://insights.sbomify.com/CVE-2023-31717/): FUXA SQL Injection vulnerability (high 7.5)
- [CVE-2023-31716](https://insights.sbomify.com/CVE-2023-31716/): FUXA vulnerable to Local File Inclusion (high 7.5)
- [CVE-2023-31714](https://insights.sbomify.com/CVE-2023-31714/): SQL injection in waqaskanju:chitor-cms (critical 9.8)
- [CVE-2023-31710](https://insights.sbomify.com/CVE-2023-31710/): Memory corruption in tp-link:archer ax21 firmware (critical 9.8)
- [CVE-2023-3171](https://insights.sbomify.com/CVE-2023-3171/): Eap-7: heap exhaustion via deserialization (high 7.5)
- [CVE-2023-31708](https://insights.sbomify.com/CVE-2023-31708/): Cross-site request forgery in eyoucms:eyoucms (medium 4.3)
- [CVE-2023-31707](https://insights.sbomify.com/CVE-2023-31707/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2023-31705](https://insights.sbomify.com/CVE-2023-31705/): Cross-site scripting in task reminder system project:task reminder system (medium 5.4)
- [CVE-2023-31704](https://insights.sbomify.com/CVE-2023-31704/): Privilege escalation in oretnom23:online computer and laptop store (critical 9.8)
- [CVE-2023-31703](https://insights.sbomify.com/CVE-2023-31703/): Cross-site scripting in escanav:escan management console (critical 9.0)
- [CVE-2023-31702](https://insights.sbomify.com/CVE-2023-31702/): SQL injection in escanav:escan management console (high 7.2)
- [CVE-2023-31701](https://insights.sbomify.com/CVE-2023-31701/): Command injection in tp-link:tl-wpa4530 kit firmware (high 8.8)
- [CVE-2023-31700](https://insights.sbomify.com/CVE-2023-31700/): Command injection in tp-link:tl-wpa4530 kit firmware (high 8.8)
- [CVE-2023-3170](https://insights.sbomify.com/CVE-2023-3170/): tagDiv Composer < 4.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-31699](https://insights.sbomify.com/CVE-2023-31699/): Cross-site scripting in churchcrm:churchcrm (medium 4.8)
- [CVE-2023-31698](https://insights.sbomify.com/CVE-2023-31698/): Cross-site scripting in bludit:bludit (medium 5.4)
- [CVE-2023-3169](https://insights.sbomify.com/CVE-2023-3169/): tagDiv Composer < 4.2 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-31689](https://insights.sbomify.com/CVE-2023-31689/): File upload in wcms:wcms (critical 9.8)
- [CVE-2023-3168](https://insights.sbomify.com/CVE-2023-3168/): WP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject (high 7.2)
- [CVE-2023-31679](https://insights.sbomify.com/CVE-2023-31679/): Missing authorization in videogo project:videogo (high 7.5)
- [CVE-2023-31678](https://insights.sbomify.com/CVE-2023-31678/): Auth bypass in videogo project:videogo (medium 5.3)
- [CVE-2023-31677](https://insights.sbomify.com/CVE-2023-31677/): Missing authorization in luowice:luowice (high 7.5)
- [CVE-2023-31672](https://insights.sbomify.com/CVE-2023-31672/): SQL injection in ai-dev:ailinear (critical 9.8)
- [CVE-2023-31671](https://insights.sbomify.com/CVE-2023-31671/): SQL injection in webbax:postfinance (critical 9.8)
- [CVE-2023-31670](https://insights.sbomify.com/CVE-2023-31670/): Denial of service in webassembly:webassembly binary toolkit (high 7.5)
- [CVE-2023-3167](https://insights.sbomify.com/CVE-2023-3167/): Mail Queue <= 1.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject (high 7.2)
- [CVE-2023-31669](https://insights.sbomify.com/CVE-2023-31669/): Denial of service in webassembly:webassembly binary toolkit (medium 5.5)
- [CVE-2023-31664](https://insights.sbomify.com/CVE-2023-31664/): Cross-site scripting in wso2:api manager (medium 6.1)
- [CVE-2023-3166](https://insights.sbomify.com/CVE-2023-3166/): Lana Email Logger <= 1.0.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject (high 7.2)
- [CVE-2023-31655](https://insights.sbomify.com/CVE-2023-31655/): Denial of service in redis:redis (high 7.5)
- [CVE-2023-31654](https://insights.sbomify.com/CVE-2023-31654/): Other in redis:redisraft (critical 9.8)
- [CVE-2023-3165](https://insights.sbomify.com/CVE-2023-3165/): SourceCodester Life Insurance Management System POST Parameter insertNominee.php cross site scripting (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/315/