# Vulnerabilities published in 2023


- [CVE-2023-26864](https://insights.sbomify.com/CVE-2023-26864/): SQL injection in smplredirectionsmanager project:smplredirectionsmanager (critical 9.8)
- [CVE-2023-26861](https://insights.sbomify.com/CVE-2023-26861/): SQL injection in vivawallet:viva wallet (critical 9.8)
- [CVE-2023-26860](https://insights.sbomify.com/CVE-2023-26860/): SQL injection in save your carts and buy later or send it project:save your carts and buy later or send it (high 8.8)
- [CVE-2023-2686](https://insights.sbomify.com/CVE-2023-2686/): Memory corruption in Gecko Platform (critical 9.8)
- [CVE-2023-26859](https://insights.sbomify.com/CVE-2023-26859/): SQL injection in brevo:brevo (critical 9.8)
- [CVE-2023-26858](https://insights.sbomify.com/CVE-2023-26858/): SQL injection in myprestamodules:frequently asked questions page (critical 9.8)
- [CVE-2023-26857](https://insights.sbomify.com/CVE-2023-26857/): File upload in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2023-26856](https://insights.sbomify.com/CVE-2023-26856/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2023-26855](https://insights.sbomify.com/CVE-2023-26855/): Weak cryptography in churchcrm:churchcrm (high 7.5)
- [CVE-2023-26852](https://insights.sbomify.com/CVE-2023-26852/): File upload in textpattern:textpattern (high 7.2)
- [CVE-2023-2685](https://insights.sbomify.com/CVE-2023-2685/): Unquoted Service Path in ABB AO-OPC (high 7.2)
- [CVE-2023-26848](https://insights.sbomify.com/CVE-2023-26848/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-26847](https://insights.sbomify.com/CVE-2023-26847/): Cross-site scripting in opencats:opencats (medium 5.4)
- [CVE-2023-26846](https://insights.sbomify.com/CVE-2023-26846/): Cross-site scripting in opencats:opencats (medium 5.4)
- [CVE-2023-26845](https://insights.sbomify.com/CVE-2023-26845/): Cross-site request forgery in opencats:opencats (medium 4.3)
- [CVE-2023-26843](https://insights.sbomify.com/CVE-2023-26843/): Cross-site scripting in churchcrm:churchcrm (medium 5.4)
- [CVE-2023-26842](https://insights.sbomify.com/CVE-2023-26842/): Cross-site scripting in churchcrm:churchcrm (medium 5.4)
- [CVE-2023-26841](https://insights.sbomify.com/CVE-2023-26841/): Cross-site request forgery in churchcrm:churchcrm (medium 6.5)
- [CVE-2023-26840](https://insights.sbomify.com/CVE-2023-26840/): Cross-site request forgery in churchcrm:churchcrm (medium 5.3)
- [CVE-2023-2684](https://insights.sbomify.com/CVE-2023-2684/): File Renaming on Upload < 2.5.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-26839](https://insights.sbomify.com/CVE-2023-26839/): Cross-site request forgery in churchcrm:churchcrm (medium 4.3)
- [CVE-2023-26830](https://insights.sbomify.com/CVE-2023-26830/): File upload in gladinet:centrestack (high 7.2)
- [CVE-2023-2683](https://insights.sbomify.com/CVE-2023-2683/): Connection update while closing connection may lead to denial-of-service (medium 5.3)
- [CVE-2023-26829](https://insights.sbomify.com/CVE-2023-26829/): Auth bypass in gladinet:centrestack (critical 9.8)
- [CVE-2023-26822](https://insights.sbomify.com/CVE-2023-26822/): Command injection in dlink:go-rt-ac750 firmware (critical 9.8)
- [CVE-2023-26820](https://insights.sbomify.com/CVE-2023-26820/): Path traversal in siteproxy project:siteproxy (high 7.5)
- [CVE-2023-2682](https://insights.sbomify.com/CVE-2023-2682/): Caton Live Mini_HTTPD ping.cgi command injection (medium 6.3)
- [CVE-2023-26819](https://insights.sbomify.com/CVE-2023-26819/): Denial of service in cJSON (low 2.9)
- [CVE-2023-26818](https://insights.sbomify.com/CVE-2023-26818/): Security feature bypass in telegram:telegram (medium 5.5)
- [CVE-2023-26817](https://insights.sbomify.com/CVE-2023-26817/): Code injection in pgyer:codefever (high 8.8)
- [CVE-2023-26813](https://insights.sbomify.com/CVE-2023-26813/): SQL injection in wang.market:wangmarket (critical 9.8)
- [CVE-2023-2681](https://insights.sbomify.com/CVE-2023-2681/): SQL Injection on Jorani (high 8.8)
- [CVE-2023-26806](https://insights.sbomify.com/CVE-2023-26806/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2023-26805](https://insights.sbomify.com/CVE-2023-26805/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2023-26802](https://insights.sbomify.com/CVE-2023-26802/): Path traversal in dcnglobal:dcbi-netlog-lab firmware (critical 9.8)
- [CVE-2023-26801](https://insights.sbomify.com/CVE-2023-26801/): Command injection in lb-link:bl-ac1900 firmware (critical 9.8)
- [CVE-2023-26800](https://insights.sbomify.com/CVE-2023-26800/): Command injection in ruijienetworks:rg-ew1200 firmware (critical 9.8)
- [CVE-2023-2680](https://insights.sbomify.com/CVE-2023-2680/): Dma reentrancy issue (incomplete fix for cve-2021-3750) (high 7.5)
- [CVE-2023-26793](https://insights.sbomify.com/CVE-2023-26793/): Memory corruption in libmodbus:libmodbus (critical 9.8)
- [CVE-2023-2679](https://insights.sbomify.com/CVE-2023-2679/): Data leakage in Adobe connector for SPE edition of SLM (medium 4.1)
- [CVE-2023-26789](https://insights.sbomify.com/CVE-2023-26789/): Cross-site scripting in veritas:netbackup opscenter (medium 6.1)
- [CVE-2023-26788](https://insights.sbomify.com/CVE-2023-26788/): Other in veritas:netbackup appliance firmware (medium 6.1)
- [CVE-2023-26785](https://insights.sbomify.com/CVE-2023-26785/): Code injection in mariadb:mariadb (critical 9.8)
- [CVE-2023-26784](https://insights.sbomify.com/CVE-2023-26784/): SQL injection in tosec:kirin fortress machine (critical 9.8)
- [CVE-2023-26782](https://insights.sbomify.com/CVE-2023-26782/): Code injection in chshcms:mccms (medium 6.5)
- [CVE-2023-26781](https://insights.sbomify.com/CVE-2023-26781/): SQL injection in chshcms:mccms (critical 9.8)
- [CVE-2023-26780](https://insights.sbomify.com/CVE-2023-26780/): SQL injection in yf-exam project:yf-exam (critical 9.8)
- [CVE-2023-2678](https://insights.sbomify.com/CVE-2023-2678/): SourceCodester File Tracker Manager System POST Parameter save_user.php cross site scripting (low 3.5)
- [CVE-2023-26779](https://insights.sbomify.com/CVE-2023-26779/): Deserialization in yf-exam project:yf-exam (critical 9.8)
- [CVE-2023-26777](https://insights.sbomify.com/CVE-2023-26777/): Cross-site scripting in uptime kuma project:uptime kuma (medium 6.1)
- [CVE-2023-26776](https://insights.sbomify.com/CVE-2023-26776/): Cross-site scripting in monitorr:monitorr (medium 6.1)
- [CVE-2023-26775](https://insights.sbomify.com/CVE-2023-26775/): File upload in monitorr:monitorr (high 7.8)
- [CVE-2023-26774](https://insights.sbomify.com/CVE-2023-26774/): Information disclosure in sales tracker management system project:sales tracker management system (high 7.5)
- [CVE-2023-26773](https://insights.sbomify.com/CVE-2023-26773/): Cross-site scripting in sales tracker management system project:sales tracker management system (medium 6.1)
- [CVE-2023-26771](https://insights.sbomify.com/CVE-2023-26771/): Cross-site scripting in taskcafe project:taskcafe (medium 6.5)
- [CVE-2023-26770](https://insights.sbomify.com/CVE-2023-26770/): Auth bypass in taskcafe project:taskcafe (critical 9.8)
- [CVE-2023-2677](https://insights.sbomify.com/CVE-2023-2677/): SourceCodester Covid-19 Contact Tracing System manage.php sql injection (medium 6.3)
- [CVE-2023-26769](https://insights.sbomify.com/CVE-2023-26769/): Memory corruption in liblouis:liblouis (high 7.5)
- [CVE-2023-26768](https://insights.sbomify.com/CVE-2023-26768/): Memory corruption in liblouis:liblouis (high 7.5)
- [CVE-2023-26767](https://insights.sbomify.com/CVE-2023-26767/): Memory corruption in liblouis:liblouis (high 7.5)
- [CVE-2023-26762](https://insights.sbomify.com/CVE-2023-26762/): File upload in smeup:erp (high 8.8)
- [CVE-2023-26760](https://insights.sbomify.com/CVE-2023-26760/): Information disclosure in smeup:erp (high 7.5)
- [CVE-2023-2676](https://insights.sbomify.com/CVE-2023-2676/): H3C R160 aspForm stack-based overflow (medium 5.5)
- [CVE-2023-26759](https://insights.sbomify.com/CVE-2023-26759/): Command injection in smeup:erp (high 8.8)
- [CVE-2023-26758](https://insights.sbomify.com/CVE-2023-26758/): Path traversal in smeup:erp (high 7.5)
- [CVE-2023-26756](https://insights.sbomify.com/CVE-2023-26756/): Auth bypass in revive:adserver (high 7.5)
- [CVE-2023-26750](https://insights.sbomify.com/CVE-2023-26750/): SQL injection in yiiframework:yii (critical 9.8)
- [CVE-2023-2675](https://insights.sbomify.com/CVE-2023-2675/): Improper Restriction of Excessive Authentication Attempts in linagora/twake (medium 5.5)
- [CVE-2023-2674](https://insights.sbomify.com/CVE-2023-2674/): Improper Access Control in openemr/openemr (high 8.8)
- [CVE-2023-26735](https://insights.sbomify.com/CVE-2023-26735/): Server-side request forgery in prometheus:blackbox exporter (high 7.5)
- [CVE-2023-26733](https://insights.sbomify.com/CVE-2023-26733/): Memory corruption in tinytiff project:tinytiff (high 7.8)
- [CVE-2023-2673](https://insights.sbomify.com/CVE-2023-2673/): PHOENIX CONTACT: FL/TC MGUARD prone to Improper Input Validation (medium 5.3)
- [CVE-2023-2672](https://insights.sbomify.com/CVE-2023-2672/): SourceCodester Lost and Found Information System GET Parameter view.php sql injection (medium 6.3)
- [CVE-2023-2671](https://insights.sbomify.com/CVE-2023-2671/): SourceCodester Lost and Found Information System Contact Form cross site scripting (low 3.5)
- [CVE-2023-2670](https://insights.sbomify.com/CVE-2023-2670/): SourceCodester Lost and Found Information System access control (medium 6.3)
- [CVE-2023-26692](https://insights.sbomify.com/CVE-2023-26692/): Cross-site scripting in zcbs:zbbs (medium 6.1)
- [CVE-2023-26691](https://insights.sbomify.com/CVE-2023-26691/): Path traversal in cs-cart:cs-cart multivendor (high 7.2)
- [CVE-2023-26690](https://insights.sbomify.com/CVE-2023-26690/): File upload in cs-cart:cs-cart multivendor (high 8.8)
- [CVE-2023-2669](https://insights.sbomify.com/CVE-2023-2669/): SourceCodester Lost and Found Information System GET Parameter sql injection (medium 6.3)
- [CVE-2023-26689](https://insights.sbomify.com/CVE-2023-26689/): Missing authorization in cs-cart:cs-cart multivendor (critical 9.8)
- [CVE-2023-26688](https://insights.sbomify.com/CVE-2023-26688/): Cross-site scripting in cs-cart:cs-cart multivendor (medium 5.4)
- [CVE-2023-26687](https://insights.sbomify.com/CVE-2023-26687/): Path traversal in cs-cart:cs-cart multivendor (high 8.8)
- [CVE-2023-26686](https://insights.sbomify.com/CVE-2023-26686/): File upload in cs-cart:cs-cart multivendor (critical 9.8)
- [CVE-2023-2668](https://insights.sbomify.com/CVE-2023-2668/): SourceCodester Lost and Found Information System GET Parameter manager_category sql injection (medium 6.3)
- [CVE-2023-2667](https://insights.sbomify.com/CVE-2023-2667/): SourceCodester Lost and Found Information System cross site scripting (low 3.5)
- [CVE-2023-2666](https://insights.sbomify.com/CVE-2023-2666/): Allocation of Resources Without Limits or Throttling in froxlor/froxlor (medium 6.8)
- [CVE-2023-2665](https://insights.sbomify.com/CVE-2023-2665/): Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis (high 7.5)
- [CVE-2023-2664](https://insights.sbomify.com/CVE-2023-2664/): Stack overflow in Xpdf 4.04 due to object loop in PDF embedded file tree (low 2.9)
- [CVE-2023-2663](https://insights.sbomify.com/CVE-2023-2663/): Stack overflow in Xpdf 4.04 due to object loop in PDF page label tree (low 2.9)
- [CVE-2023-2662](https://insights.sbomify.com/CVE-2023-2662/): Divide-by-zero in Xpdf 4.04 due to bad color space object (low 2.9)
- [CVE-2023-26616](https://insights.sbomify.com/CVE-2023-26616/): Memory corruption in dlink:dir-823g firmware (critical 9.8)
- [CVE-2023-26615](https://insights.sbomify.com/CVE-2023-26615/): Auth bypass in dlink:dir-823g firmware (high 7.5)
- [CVE-2023-26613](https://insights.sbomify.com/CVE-2023-26613/): Command injection in dlink:dir-823g firmware (critical 9.8)
- [CVE-2023-26612](https://insights.sbomify.com/CVE-2023-26612/): Memory corruption in dlink:dir-823g firmware (critical 9.8)
- [CVE-2023-2661](https://insights.sbomify.com/CVE-2023-2661/): SourceCodester Online Computer and Laptop Store Master.php sql injection (medium 6.3)
- [CVE-2023-26609](https://insights.sbomify.com/CVE-2023-26609/): Command injection in abus:tvip 20000-21150 firmware (high 7.2)
- [CVE-2023-26608](https://insights.sbomify.com/CVE-2023-26608/): Cross-site scripting in vxcontrol:soldr (medium 5.4)
- [CVE-2023-26607](https://insights.sbomify.com/CVE-2023-26607/): Memory corruption in linux:linux kernel (high 7.1)
- [CVE-2023-26606](https://insights.sbomify.com/CVE-2023-26606/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2023-26605](https://insights.sbomify.com/CVE-2023-26605/): Use after free in linux:linux kernel (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/354/