# Vulnerabilities published in 2023


- [CVE-2023-27210](https://insights.sbomify.com/CVE-2023-27210/): SQL injection in online pizza ordering system project:online pizza ordering system (critical 9.8)
- [CVE-2023-2721](https://insights.sbomify.com/CVE-2023-2721/): Use after free in Chrome (high 8.8)
- [CVE-2023-27208](https://insights.sbomify.com/CVE-2023-27208/): Cross-site scripting in online pizza ordering system project:online pizza ordering system (medium 6.1)
- [CVE-2023-27207](https://insights.sbomify.com/CVE-2023-27207/): SQL injection in online pizza ordering system project:online pizza ordering system (critical 9.8)
- [CVE-2023-27206](https://insights.sbomify.com/CVE-2023-27206/): Cross-site scripting in mayurik:best pos management system (medium 6.1)
- [CVE-2023-27205](https://insights.sbomify.com/CVE-2023-27205/): SQL injection in mayurik:best pos management system (critical 9.8)
- [CVE-2023-27204](https://insights.sbomify.com/CVE-2023-27204/): SQL injection in mayurik:best pos management system (critical 9.8)
- [CVE-2023-27203](https://insights.sbomify.com/CVE-2023-27203/): SQL injection in mayurik:best pos management system (critical 9.8)
- [CVE-2023-27202](https://insights.sbomify.com/CVE-2023-27202/): SQL injection in mayurik:best pos management system (critical 9.8)
- [CVE-2023-27199](https://insights.sbomify.com/CVE-2023-27199/): Security feature bypass in paxtechnology:pax a930 firmware (medium 6.7)
- [CVE-2023-27198](https://insights.sbomify.com/CVE-2023-27198/): Command injection in paxtechnology:pax a930 firmware (medium 6.8)
- [CVE-2023-27197](https://insights.sbomify.com/CVE-2023-27197/): Privilege escalation in paxtechnology:pax a930 firmware (medium 6.7)
- [CVE-2023-27195](https://insights.sbomify.com/CVE-2023-27195/): Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration (critical 9.8)
- [CVE-2023-27193](https://insights.sbomify.com/CVE-2023-27193/): Privilege escalation in dualspace:space clean \& super cleaner (high 7.8)
- [CVE-2023-27192](https://insights.sbomify.com/CVE-2023-27192/): Denial of service in dualspace:super security (critical 9.8)
- [CVE-2023-27191](https://insights.sbomify.com/CVE-2023-27191/): Denial of service in dualspace:super security (high 7.5)
- [CVE-2023-2719](https://insights.sbomify.com/CVE-2023-2719/): SupportCandy < 3.1.7 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-27180](https://insights.sbomify.com/CVE-2023-27180/): Information disclosure in gdidees:gdidees cms (high 7.5)
- [CVE-2023-2718](https://insights.sbomify.com/CVE-2023-2718/): Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-27179](https://insights.sbomify.com/CVE-2023-27179/): Path traversal in gdidees:gdidees cms (high 7.5)
- [CVE-2023-27178](https://insights.sbomify.com/CVE-2023-27178/): File upload in gdidees:gdidees cms (critical 9.8)
- [CVE-2023-27172](https://insights.sbomify.com/CVE-2023-27172/): Weak cryptography in xpand-it:write-back manager (critical 9.1)
- [CVE-2023-27170](https://insights.sbomify.com/CVE-2023-27170/): Path traversal in xpand-it:write-back manager (high 7.5)
- [CVE-2023-2717](https://insights.sbomify.com/CVE-2023-2717/): Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins (medium 5.4)
- [CVE-2023-27169](https://insights.sbomify.com/CVE-2023-27169/): Hardcoded credentials in xpand-it:write-back manager (medium 6.5)
- [CVE-2023-27168](https://insights.sbomify.com/CVE-2023-27168/): File upload in xpand-it:write-back manager (critical 9.8)
- [CVE-2023-27167](https://insights.sbomify.com/CVE-2023-27167/): SQL injection in supremainc:biostar 2 (medium 6.5)
- [CVE-2023-27164](https://insights.sbomify.com/CVE-2023-27164/): File upload in halo:halo (medium 4.8)
- [CVE-2023-27163](https://insights.sbomify.com/CVE-2023-27163/): request-baskets vulnerable to Server-Side Request Forgery (medium 6.5)
- [CVE-2023-27162](https://insights.sbomify.com/CVE-2023-27162/): OpenAPI Generator vulnerable to Server-Side Request Forgery (critical 9.1)
- [CVE-2023-27161](https://insights.sbomify.com/CVE-2023-27161/): Server-side request forgery in jellyfin:jellyfin (high 7.5)
- [CVE-2023-27160](https://insights.sbomify.com/CVE-2023-27160/): Server-side request forgery in forem:forem (high 7.2)
- [CVE-2023-2716](https://insights.sbomify.com/CVE-2023-2716/): Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload (medium 5.4)
- [CVE-2023-27159](https://insights.sbomify.com/CVE-2023-27159/): Appwrite Server-Side Request Forgery vulnerability (high 7.5)
- [CVE-2023-27152](https://insights.sbomify.com/CVE-2023-27152/): Auth bypass in opnsense:opnsense (critical 9.8)
- [CVE-2023-27151](https://insights.sbomify.com/CVE-2023-27151/): Cross-site scripting in opencrx:opencrx (medium 6.1)
- [CVE-2023-27150](https://insights.sbomify.com/CVE-2023-27150/): OpenCRX Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-2715](https://insights.sbomify.com/CVE-2023-2715/): Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation (medium 4.3)
- [CVE-2023-27149](https://insights.sbomify.com/CVE-2023-27149/): Cross-site scripting in enhancesoft:osticket (medium 4.8)
- [CVE-2023-27148](https://insights.sbomify.com/CVE-2023-27148/): Cross-site scripting in enhancesoft:osticket (medium 4.8)
- [CVE-2023-2714](https://insights.sbomify.com/CVE-2023-2714/): Groundhogg <= 2.7.9.8 - Missing Authorization to Update License (medium 4.3)
- [CVE-2023-27135](https://insights.sbomify.com/CVE-2023-27135/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-27133](https://insights.sbomify.com/CVE-2023-27133/): Misconfiguration in tsplus:tsplus remote work (critical 9.8)
- [CVE-2023-27132](https://insights.sbomify.com/CVE-2023-27132/): Information disclosure in tsplus:tsplus remote work (critical 9.8)
- [CVE-2023-27131](https://insights.sbomify.com/CVE-2023-27131/): Cross-site scripting in typecho:typecho (medium 4.8)
- [CVE-2023-27130](https://insights.sbomify.com/CVE-2023-27130/): Cross-site scripting in typecho:typecho (medium 4.8)
- [CVE-2023-2713](https://insights.sbomify.com/CVE-2023-2713/): IDOR vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform. (critical 9.8)
- [CVE-2023-27126](https://insights.sbomify.com/CVE-2023-27126/): Weak cryptography in tp-link:tapo c200 firmware (medium 4.6)
- [CVE-2023-27121](https://insights.sbomify.com/CVE-2023-27121/): Cross-site scripting in pleasantsolutions:pleasant password server (medium 6.1)
- [CVE-2023-2712](https://insights.sbomify.com/CVE-2023-2712/): Malicious File Upload vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform. (critical 9.8)
- [CVE-2023-27119](https://insights.sbomify.com/CVE-2023-27119/): Memory corruption in webassembly:wabt (medium 5.5)
- [CVE-2023-27117](https://insights.sbomify.com/CVE-2023-27117/): Memory corruption in webassembly:webassembly (high 7.8)
- [CVE-2023-27116](https://insights.sbomify.com/CVE-2023-27116/): Denial of service in webassembly:webassembly (medium 5.5)
- [CVE-2023-27115](https://insights.sbomify.com/CVE-2023-27115/): Memory corruption in webassembly:webassembly (medium 5.5)
- [CVE-2023-27114](https://insights.sbomify.com/CVE-2023-27114/): Null dereference in radare:radare2 (medium 5.5)
- [CVE-2023-27113](https://insights.sbomify.com/CVE-2023-27113/): SQL injection in a54552239:pearprojectapi (critical 9.8)
- [CVE-2023-27112](https://insights.sbomify.com/CVE-2023-27112/): SQL injection in a54552239:pearprojectapi (critical 9.8)
- [CVE-2023-2711](https://insights.sbomify.com/CVE-2023-2711/): Ultimate Product Catalog < 5.2.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-27108](https://insights.sbomify.com/CVE-2023-27108/): Missing authorization in kaiostech:kaios (medium 5.3)
- [CVE-2023-27107](https://insights.sbomify.com/CVE-2023-27107/): Missing authorization in myq-solution:central server (high 8.8)
- [CVE-2023-27105](https://insights.sbomify.com/CVE-2023-27105/): Path traversal in shanling:eddict player (critical 9.8)
- [CVE-2023-27103](https://insights.sbomify.com/CVE-2023-27103/): Memory corruption in struktur:libde265 (high 8.8)
- [CVE-2023-27102](https://insights.sbomify.com/CVE-2023-27102/): Null dereference in struktur:libde265 (medium 6.5)
- [CVE-2023-27100](https://insights.sbomify.com/CVE-2023-27100/): Security feature bypass in netgate:pfsense plus (critical 9.8)
- [CVE-2023-2710](https://insights.sbomify.com/CVE-2023-2710/): video carousel slider with lightbox <= 1.0.22 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-27098](https://insights.sbomify.com/CVE-2023-27098/): Hardcoded credentials in tp-link:tapo (high 7.5)
- [CVE-2023-27096](https://insights.sbomify.com/CVE-2023-27096/): Hippo4j allows attacker to obtain sensitive info via ConfigVerifyController function of Tenant Management module (medium 6.5)
- [CVE-2023-27095](https://insights.sbomify.com/CVE-2023-27095/): Exposure of Sensitive Information in OpenGoofy Hippo4j (medium 6.5)
- [CVE-2023-27094](https://insights.sbomify.com/CVE-2023-27094/): Hippo4j privilege escalation issue (high 8.8)
- [CVE-2023-27093](https://insights.sbomify.com/CVE-2023-27093/): Cross-site scripting in my-blog project:my-blog (medium 6.1)
- [CVE-2023-27092](https://insights.sbomify.com/CVE-2023-27092/): Cross-site scripting in jbootfly project:jbootfly (medium 6.1)
- [CVE-2023-27091](https://insights.sbomify.com/CVE-2023-27091/): Auth bypass in teacms project:teacms (high 7.2)
- [CVE-2023-27090](https://insights.sbomify.com/CVE-2023-27090/): Cross-site scripting in teacms project:teacms (medium 5.4)
- [CVE-2023-2709](https://insights.sbomify.com/CVE-2023-2709/): AN_GradeBook <= 5.0.1 - Admin+ XSS (medium 4.8)
- [CVE-2023-27089](https://insights.sbomify.com/CVE-2023-27089/): Cross-site scripting in ehuacui-bbs project:ehuacui-bbs (high 8.2)
- [CVE-2023-27088](https://insights.sbomify.com/CVE-2023-27088/): Missing authorization in feiqu-opensource project:feiqu-opensource (high 8.8)
- [CVE-2023-27087](https://insights.sbomify.com/CVE-2023-27087/): Xuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter (high 7.5)
- [CVE-2023-27084](https://insights.sbomify.com/CVE-2023-27084/): Information disclosure in iteachyou:dreamer cms (medium 5.3)
- [CVE-2023-27083](https://insights.sbomify.com/CVE-2023-27083/): File upload in pluck-cms:pluck (high 7.2)
- [CVE-2023-27082](https://insights.sbomify.com/CVE-2023-27082/): Cross-site scripting in pluck-cms:pluck (medium 4.8)
- [CVE-2023-2708](https://insights.sbomify.com/CVE-2023-2708/): Video Gallery <= 1.0.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-27079](https://insights.sbomify.com/CVE-2023-27079/): Command injection in tenda:g103 firmware (high 7.5)
- [CVE-2023-27078](https://insights.sbomify.com/CVE-2023-27078/): Command injection in tp-link:tl-mr3020 firmware (critical 9.8)
- [CVE-2023-27077](https://insights.sbomify.com/CVE-2023-27077/): Memory corruption in 360:d901 firmware (high 7.5)
- [CVE-2023-27076](https://insights.sbomify.com/CVE-2023-27076/): Command injection in tenda:g103 firmware (critical 9.8)
- [CVE-2023-27075](https://insights.sbomify.com/CVE-2023-27075/): Stored cross site scripting in Microbin (medium 5.4)
- [CVE-2023-27074](https://insights.sbomify.com/CVE-2023-27074/): SQL injection in phpgurukul:bp monitoring management system (critical 9.8)
- [CVE-2023-27073](https://insights.sbomify.com/CVE-2023-27073/): Cross-site request forgery in oretnom23:online food ordering system (medium 6.5)
- [CVE-2023-27070](https://insights.sbomify.com/CVE-2023-27070/): Cross-site scripting in totaljs:openplatform (medium 5.4)
- [CVE-2023-2707](https://insights.sbomify.com/CVE-2023-2707/): Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-27069](https://insights.sbomify.com/CVE-2023-27069/): Cross-site scripting in totaljs:openplatform (medium 5.4)
- [CVE-2023-27068](https://insights.sbomify.com/CVE-2023-27068/): Deserialization in sitecore:experience platform (critical 9.8)
- [CVE-2023-27067](https://insights.sbomify.com/CVE-2023-27067/): Path traversal in sitecore:experience platform (high 7.5)
- [CVE-2023-27066](https://insights.sbomify.com/CVE-2023-27066/): Path traversal in sitecore:experience platform (medium 6.5)
- [CVE-2023-27065](https://insights.sbomify.com/CVE-2023-27065/): Memory corruption in tenda:w15e firmware (high 7.5)
- [CVE-2023-27064](https://insights.sbomify.com/CVE-2023-27064/): Memory corruption in tenda:w15e firmware (high 7.5)
- [CVE-2023-27063](https://insights.sbomify.com/CVE-2023-27063/): Memory corruption in tenda:w15e firmware (critical 9.8)
- [CVE-2023-27062](https://insights.sbomify.com/CVE-2023-27062/): Memory corruption in tenda:w15e firmware (high 7.5)
- [CVE-2023-27061](https://insights.sbomify.com/CVE-2023-27061/): Memory corruption in tenda:w15e firmware (critical 9.8)
- [CVE-2023-27060](https://insights.sbomify.com/CVE-2023-27060/): Code injection in lightcms project:lightcms (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/352/