# Vulnerabilities published in 2023


- [CVE-2023-30253](https://insights.sbomify.com/CVE-2023-30253/): Dolibarr vulnerable to remote code execution via uppercase manipulation (high 8.8)
- [CVE-2023-3025](https://insights.sbomify.com/CVE-2023-3025/): Dropbox Folder Share <= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link' (high 7.2)
- [CVE-2023-30247](https://insights.sbomify.com/CVE-2023-30247/): File upload in storage unit rental management system project:storage unit rental management system (critical 9.8)
- [CVE-2023-30246](https://insights.sbomify.com/CVE-2023-30246/): SQL injection in judging management system project:judging management system (critical 9.8)
- [CVE-2023-30245](https://insights.sbomify.com/CVE-2023-30245/): SQL injection in judging management system project:judging management system (critical 9.8)
- [CVE-2023-30243](https://insights.sbomify.com/CVE-2023-30243/): SQL injection in netentsec:application security gateway (high 7.5)
- [CVE-2023-30242](https://insights.sbomify.com/CVE-2023-30242/): SQL injection in netentsec:application security gateway (critical 9.8)
- [CVE-2023-3024](https://insights.sbomify.com/CVE-2023-3024/): Bluetooth LE segmented 'prepare write response' packet may lead to out-of-bounds memory access (medium 5.9)
- [CVE-2023-30237](https://insights.sbomify.com/CVE-2023-30237/): Code injection in cyberghostvpn:cyberghost (high 7.8)
- [CVE-2023-3023](https://insights.sbomify.com/CVE-2023-3023/): WP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby' (high 7.2)
- [CVE-2023-30226](https://insights.sbomify.com/CVE-2023-30226/): Denial of service in rizin:rizin (medium 5.5)
- [CVE-2023-30223](https://insights.sbomify.com/CVE-2023-30223/): Auth bypass in 4d:server (high 7.5)
- [CVE-2023-30222](https://insights.sbomify.com/CVE-2023-30222/): Information disclosure in 4d:server (high 7.5)
- [CVE-2023-3022](https://insights.sbomify.com/CVE-2023-3022/): Memory corruption in Linux Kernel (IPv6) (medium 5.5)
- [CVE-2023-30216](https://insights.sbomify.com/CVE-2023-30216/): Missing authorization in newbee-mall project:newbee-mall (medium 5.4)
- [CVE-2023-30212](https://insights.sbomify.com/CVE-2023-30212/): Cross-site scripting in ourphp:ourphp (medium 6.1)
- [CVE-2023-30211](https://insights.sbomify.com/CVE-2023-30211/): SQL injection in ourphp:ourphp (critical 9.8)
- [CVE-2023-30210](https://insights.sbomify.com/CVE-2023-30210/): Cross-site scripting in ourphp:ourphp (medium 6.1)
- [CVE-2023-3021](https://insights.sbomify.com/CVE-2023-3021/): Cross-site Scripting (XSS) - Stored in mkucej/i-librarian-free (medium 4.1)
- [CVE-2023-30207](https://insights.sbomify.com/CVE-2023-30207/): Denial of service in kodi:kodi (medium 5.5)
- [CVE-2023-30205](https://insights.sbomify.com/CVE-2023-30205/): Cross-site scripting in douphp:douphp (medium 4.8)
- [CVE-2023-30204](https://insights.sbomify.com/CVE-2023-30204/): SQL injection in judging management system project:judging management system (critical 9.8)
- [CVE-2023-30203](https://insights.sbomify.com/CVE-2023-30203/): SQL injection in judging management system project:judging management system (critical 9.8)
- [CVE-2023-30200](https://insights.sbomify.com/CVE-2023-30200/): Path traversal in advancedplugins:ultimateimagetool (high 7.5)
- [CVE-2023-3020](https://insights.sbomify.com/CVE-2023-3020/): Cross-site Scripting (XSS) - Reflected in mkucej/i-librarian-free (critical 9.0)
- [CVE-2023-30199](https://insights.sbomify.com/CVE-2023-30199/): Path traversal in webbax:customexporter (high 7.5)
- [CVE-2023-30198](https://insights.sbomify.com/CVE-2023-30198/): Path traversal in webbax:winbizpayment (high 7.5)
- [CVE-2023-30197](https://insights.sbomify.com/CVE-2023-30197/): Path traversal in webbax:myinventory (high 7.5)
- [CVE-2023-30196](https://insights.sbomify.com/CVE-2023-30196/): Path traversal in webbax:salesbooster (high 7.5)
- [CVE-2023-30195](https://insights.sbomify.com/CVE-2023-30195/): Missing authorization in lineagrafica:lgdetailedorder (high 7.5)
- [CVE-2023-30194](https://insights.sbomify.com/CVE-2023-30194/): SQL injection in prestashop:poststaticfooter (critical 9.8)
- [CVE-2023-30192](https://insights.sbomify.com/CVE-2023-30192/): SQL injection in prestashop:possearchproducts (critical 9.8)
- [CVE-2023-30191](https://insights.sbomify.com/CVE-2023-30191/): SQL injection in cdesigner project:cdesigner (critical 9.8)
- [CVE-2023-3019](https://insights.sbomify.com/CVE-2023-3019/): Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (medium 6.0)
- [CVE-2023-30189](https://insights.sbomify.com/CVE-2023-30189/): SQL injection in posthemes:posstaticblocks (critical 9.8)
- [CVE-2023-30188](https://insights.sbomify.com/CVE-2023-30188/): Denial of service in onlyoffice:document server (high 7.5)
- [CVE-2023-30187](https://insights.sbomify.com/CVE-2023-30187/): Memory corruption in onlyoffice:document server (critical 9.8)
- [CVE-2023-30186](https://insights.sbomify.com/CVE-2023-30186/): Use after free in onlyoffice:document server (critical 9.8)
- [CVE-2023-30185](https://insights.sbomify.com/CVE-2023-30185/): File upload in crmeb:crmeb (critical 9.8)
- [CVE-2023-30184](https://insights.sbomify.com/CVE-2023-30184/): Cross-site scripting in typecho:typecho (medium 5.4)
- [CVE-2023-3018](https://insights.sbomify.com/CVE-2023-3018/): SourceCodester Lost and Found Information System access control (medium 6.3)
- [CVE-2023-30179](https://insights.sbomify.com/CVE-2023-30179/): Code injection in craftcms:craft cms (high 7.2)
- [CVE-2023-30177](https://insights.sbomify.com/CVE-2023-30177/): Cross Site Scripting in CraftCMS (medium 6.1)
- [CVE-2023-30172](https://insights.sbomify.com/CVE-2023-30172/): mflow vulnerable to directory traversal (high 7.5)
- [CVE-2023-3017](https://insights.sbomify.com/CVE-2023-3017/): SourceCodester Lost and Found Information System Manage User Page cross site scripting (low 2.4)
- [CVE-2023-3016](https://insights.sbomify.com/CVE-2023-3016/): yiwent Vip Video Analysis admincore.php cross site scripting (low 3.5)
- [CVE-2023-30154](https://insights.sbomify.com/CVE-2023-30154/): SQL injection in shoprunners:aftermail (critical 9.8)
- [CVE-2023-30153](https://insights.sbomify.com/CVE-2023-30153/): SQL injection in prestashop:payplug (critical 9.8)
- [CVE-2023-30151](https://insights.sbomify.com/CVE-2023-30151/): SQL injection in boxtal:envoimoinscher (critical 9.8)
- [CVE-2023-30150](https://insights.sbomify.com/CVE-2023-30150/): SQL injection in leotheme:leocustomajax (critical 9.8)
- [CVE-2023-3015](https://insights.sbomify.com/CVE-2023-3015/): yiwent Vip Video Analysis title.php server-side request forgery (medium 6.3)
- [CVE-2023-30149](https://insights.sbomify.com/CVE-2023-30149/): SQL injection in ebewe:city autocomplete (critical 9.8)
- [CVE-2023-30148](https://insights.sbomify.com/CVE-2023-30148/): Cross-site scripting in store-opart:multi html block (medium 6.1)
- [CVE-2023-30146](https://insights.sbomify.com/CVE-2023-30146/): Information disclosure in assmann:ht-ip211hdp firmware (high 7.5)
- [CVE-2023-30145](https://insights.sbomify.com/CVE-2023-30145/): Server-Side Template Injection in Camaleon CMS (critical 9.8)
- [CVE-2023-3014](https://insights.sbomify.com/CVE-2023-3014/): BeipyVideoResolution admincore.php cross site scripting (low 3.5)
- [CVE-2023-30135](https://insights.sbomify.com/CVE-2023-30135/): Command injection in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-30132](https://insights.sbomify.com/CVE-2023-30132/): Hardcoded credentials in ixpdata:easyinstall (high 7.8)
- [CVE-2023-30131](https://insights.sbomify.com/CVE-2023-30131/): Code injection in ixpdata:easyinstall (critical 9.8)
- [CVE-2023-30130](https://insights.sbomify.com/CVE-2023-30130/): CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter (high 8.8)
- [CVE-2023-3013](https://insights.sbomify.com/CVE-2023-3013/): Unchecked Return Value in gpac/gpac (medium 4.4)
- [CVE-2023-30125](https://insights.sbomify.com/CVE-2023-30125/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2023-30124](https://insights.sbomify.com/CVE-2023-30124/): LavaLite vulnerable to Cross Site Scripting (medium 5.4)
- [CVE-2023-30123](https://insights.sbomify.com/CVE-2023-30123/): Cross-site scripting in wuzhicms:wuzhicms (medium 5.4)
- [CVE-2023-30122](https://insights.sbomify.com/CVE-2023-30122/): File upload in oretnom23:online food ordering system (critical 9.8)
- [CVE-2023-3012](https://insights.sbomify.com/CVE-2023-3012/): NULL Pointer Dereference in gpac/gpac (medium 5.3)
- [CVE-2023-30112](https://insights.sbomify.com/CVE-2023-30112/): SQL injection in medicine tracker system project:medicine tracker system (high 7.5)
- [CVE-2023-30111](https://insights.sbomify.com/CVE-2023-30111/): Cross-site scripting in medicine tracker system project:medicine tracker system (medium 6.1)
- [CVE-2023-3011](https://insights.sbomify.com/CVE-2023-3011/): ARMember <= 4.0.5 - Cross-Site Request Forgery (medium 6.5)
- [CVE-2023-30106](https://insights.sbomify.com/CVE-2023-30106/): Cross-site scripting in medicine tracker system project:medicine tracker system (medium 6.1)
- [CVE-2023-3010](https://insights.sbomify.com/CVE-2023-3010/): Cross-site scripting in worldmap-panel (high 7.3)
- [CVE-2023-30097](https://insights.sbomify.com/CVE-2023-30097/): Cross-site scripting in totaljs:messenger (medium 5.4)
- [CVE-2023-30096](https://insights.sbomify.com/CVE-2023-30096/): Cross-site scripting in totaljs:messenger (medium 5.4)
- [CVE-2023-30095](https://insights.sbomify.com/CVE-2023-30095/): Cross-site scripting in totaljs:messenger (medium 5.4)
- [CVE-2023-30094](https://insights.sbomify.com/CVE-2023-30094/): Cross-site scripting in TotalJS (medium 5.4)
- [CVE-2023-30093](https://insights.sbomify.com/CVE-2023-30093/): ONOS vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2023-30092](https://insights.sbomify.com/CVE-2023-30092/): SQL injection in online pizza ordering system project:online pizza ordering system (critical 9.8)
- [CVE-2023-30090](https://insights.sbomify.com/CVE-2023-30090/): File upload in sem-cms:semcms (critical 9.8)
- [CVE-2023-3009](https://insights.sbomify.com/CVE-2023-3009/): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (high 8.1)
- [CVE-2023-30088](https://insights.sbomify.com/CVE-2023-30088/): Memory corruption in cesanta:mjs (medium 5.5)
- [CVE-2023-30087](https://insights.sbomify.com/CVE-2023-30087/): Memory corruption in cesanta:mjs (medium 5.5)
- [CVE-2023-30086](https://insights.sbomify.com/CVE-2023-30086/): Memory corruption in libtiff:libtiff (medium 5.5)
- [CVE-2023-30085](https://insights.sbomify.com/CVE-2023-30085/): Memory corruption in libming:libming (medium 5.5)
- [CVE-2023-30084](https://insights.sbomify.com/CVE-2023-30084/): Memory corruption in libming:libming (medium 5.5)
- [CVE-2023-30083](https://insights.sbomify.com/CVE-2023-30083/): Memory corruption in libming:libming (medium 5.5)
- [CVE-2023-30082](https://insights.sbomify.com/CVE-2023-30082/): Denial of service in enhancesoft:osticket (high 7.5)
- [CVE-2023-3008](https://insights.sbomify.com/CVE-2023-3008/): ningzichun Student Management System login.php sql injection (high 7.3)
- [CVE-2023-30077](https://insights.sbomify.com/CVE-2023-30077/): SQL injection in judging management system project:judging management system (critical 9.8)
- [CVE-2023-30076](https://insights.sbomify.com/CVE-2023-30076/): SQL injection in judging management system project:judging management system (critical 9.8)
- [CVE-2023-3007](https://insights.sbomify.com/CVE-2023-3007/): ningzichun Student Management System Password Reset resetPassword.php password recovery (medium 6.5)
- [CVE-2023-30065](https://insights.sbomify.com/CVE-2023-30065/): Command injection in mitrastar:gpt-2741gnac-n2 firmware (high 8.8)
- [CVE-2023-30063](https://insights.sbomify.com/CVE-2023-30063/): Auth bypass in dlink:dir-890l firmware (high 7.5)
- [CVE-2023-30061](https://insights.sbomify.com/CVE-2023-30061/): Auth bypass in dlink:dir-879 firmware (high 7.5)
- [CVE-2023-3006](https://insights.sbomify.com/CVE-2023-3006/): Information disclosure in Kernel (medium 5.5)
- [CVE-2023-30059](https://insights.sbomify.com/CVE-2023-30059/): An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation (medium 5.4)
- [CVE-2023-30058](https://insights.sbomify.com/CVE-2023-30058/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2023-30057](https://insights.sbomify.com/CVE-2023-30057/): Cross-site scripting in fico:origination manager decision (medium 5.4)
- [CVE-2023-30056](https://insights.sbomify.com/CVE-2023-30056/): Auth bypass in fico:origination manager decision (high 7.5)
- [CVE-2023-30054](https://insights.sbomify.com/CVE-2023-30054/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-30053](https://insights.sbomify.com/CVE-2023-30053/): Command injection in totolink:a7100ru firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/327/