# Vulnerabilities published in 2023


- [CVE-2023-26056](https://insights.sbomify.com/CVE-2023-26056/): XWiki Platform allows macro execution as any user without programming rights through the context macro (medium 5.4)
- [CVE-2023-26055](https://insights.sbomify.com/CVE-2023-26055/): XWiki Commons may allow privilege escalation to programming rights via user's first name (critical 10.0)
- [CVE-2023-26054](https://insights.sbomify.com/CVE-2023-26054/): Credentials inlined to Git URLs could end up in provenance attestation in BuildKit (medium 6.5)
- [CVE-2023-26053](https://insights.sbomify.com/CVE-2023-26053/): Gradle usage of long IDs for PGP keys opens potential for collision attacks (medium 6.6)
- [CVE-2023-26052](https://insights.sbomify.com/CVE-2023-26052/): Saleor is vulnerable to unauthenticated information disclosure via Python exceptions (low 3.7)
- [CVE-2023-26051](https://insights.sbomify.com/CVE-2023-26051/): Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions (medium 6.5)
- [CVE-2023-2605](https://insights.sbomify.com/CVE-2023-2605/): WP Brutal AI < 2.0.1 - Admin+ Reflected XSS (medium 6.1)
- [CVE-2023-26049](https://insights.sbomify.com/CVE-2023-26049/): Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty (low 2.4)
- [CVE-2023-26048](https://insights.sbomify.com/CVE-2023-26048/): OutOfMemoryError for large multipart without filename in Eclipse Jetty (medium 5.3)
- [CVE-2023-26047](https://insights.sbomify.com/CVE-2023-26047/): teler-waf contains detection rule bypass via entities payload (medium 6.5)
- [CVE-2023-26046](https://insights.sbomify.com/CVE-2023-26046/): teler-waf subject to bypass of common web attack threat rule with HTML entities payload (medium 6.5)
- [CVE-2023-26045](https://insights.sbomify.com/CVE-2023-26045/): NodeBB vulnerable to path traversal and code execution via prototype vulnerability (critical 10.0)
- [CVE-2023-26044](https://insights.sbomify.com/CVE-2023-26044/): ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits (medium 5.3)
- [CVE-2023-26043](https://insights.sbomify.com/CVE-2023-26043/): XML External Entity (XXE) injection in GeoServer style upload functionality (medium 6.5)
- [CVE-2023-26042](https://insights.sbomify.com/CVE-2023-26042/): HTML/XSS injection possibilities in Part-DB (medium 6.1)
- [CVE-2023-26041](https://insights.sbomify.com/CVE-2023-26041/): Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured (low 2.6)
- [CVE-2023-26040](https://insights.sbomify.com/CVE-2023-26040/): Discourse chat messages susceptible to Cross-site Scripting through chat excerpts (medium 6.5)
- [CVE-2023-2604](https://insights.sbomify.com/CVE-2023-2604/): Team Circle Image Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-26039](https://insights.sbomify.com/CVE-2023-26039/): ZoneMinder vulnerable to OS Command injection in daemonControl() API (high 7.1)
- [CVE-2023-26038](https://insights.sbomify.com/CVE-2023-26038/): ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php` (medium 5.4)
- [CVE-2023-26037](https://insights.sbomify.com/CVE-2023-26037/): ZoneMinder contains SQL Injection via report_event_audit (high 8.9)
- [CVE-2023-26036](https://insights.sbomify.com/CVE-2023-26036/): ZoneMinder contains Local File Inclusion vulnerability (high 8.1)
- [CVE-2023-26035](https://insights.sbomify.com/CVE-2023-26035/): ZoneMinder vulnerable to Missing Authorization (high 7.2)
- [CVE-2023-26034](https://insights.sbomify.com/CVE-2023-26034/): ZoneMinder SQL Injection (critical 9.6)
- [CVE-2023-26033](https://insights.sbomify.com/CVE-2023-26033/): Gentoo soko contains DoS attack based on SQL Injection (high 7.5)
- [CVE-2023-26032](https://insights.sbomify.com/CVE-2023-26032/): ZoneMinder contains SQL injection via malicious Jason Web Token (high 8.9)
- [CVE-2023-26031](https://insights.sbomify.com/CVE-2023-26031/): Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems (high 7.5)
- [CVE-2023-2603](https://insights.sbomify.com/CVE-2023-2603/): Integer overflow in libcap (high 7.8)
- [CVE-2023-26026](https://insights.sbomify.com/CVE-2023-26026/): IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure (medium 5.3)
- [CVE-2023-26024](https://insights.sbomify.com/CVE-2023-26024/): IBM Planning Analytics on Cloud Pak for Data information disclosure (medium 6.5)
- [CVE-2023-26023](https://insights.sbomify.com/CVE-2023-26023/): IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure (medium 6.5)
- [CVE-2023-26022](https://insights.sbomify.com/CVE-2023-26022/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-26021](https://insights.sbomify.com/CVE-2023-26021/): IBM Db2 denial of service (high 7.5)
- [CVE-2023-26020](https://insights.sbomify.com/CVE-2023-26020/): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio (medium 5.7)
- [CVE-2023-2602](https://insights.sbomify.com/CVE-2023-2602/): Denial of service in libcap (low 3.3)
- [CVE-2023-26017](https://insights.sbomify.com/CVE-2023-26017/): WordPress Jobs for WordPress Plugin <= 2.5.10.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26016](https://insights.sbomify.com/CVE-2023-26016/): WordPress Simple Portfolio Gallery Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26015](https://insights.sbomify.com/CVE-2023-26015/): WordPress MapPress Maps for WordPress Plugin <= 2.85.4 is vulnerable to SQL Injection (high 7.1)
- [CVE-2023-26014](https://insights.sbomify.com/CVE-2023-26014/): WordPress Minify HTML Plugin <= 2.1.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-26013](https://insights.sbomify.com/CVE-2023-26013/): WordPress Strong Testimonials Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-26012](https://insights.sbomify.com/CVE-2023-26012/): WordPress Custom Login Page Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26011](https://insights.sbomify.com/CVE-2023-26011/): WordPress Read More Excerpt Link Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-26010](https://insights.sbomify.com/CVE-2023-26010/): WordPress WPMobile.App Plugin <= 11.18 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2601](https://insights.sbomify.com/CVE-2023-2601/): WP Brutal AI < 2.0.0 - SQL Injection via CSRF (critical 9.8)
- [CVE-2023-26009](https://insights.sbomify.com/CVE-2023-26009/): WordPress Houzez Login Register plugin <= 2.6.3 - Privilege Escalation (critical 9.8)
- [CVE-2023-26008](https://insights.sbomify.com/CVE-2023-26008/): WordPress Top 10 Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26005](https://insights.sbomify.com/CVE-2023-26005/): WordPress Fitrush <= 1.3.4 - Local File Inclusion Vulnerability (high 8.1)
- [CVE-2023-26003](https://insights.sbomify.com/CVE-2023-26003/): WordPress WP Post Corrector <= 1.0.2 - SQL Injection Vulnerability (high 7.6)
- [CVE-2023-26002](https://insights.sbomify.com/CVE-2023-26002/): WordPress 6Storage Rentals <= 2.19.5 - Broken Access Control Vulnerability (medium 4.3)
- [CVE-2023-26001](https://insights.sbomify.com/CVE-2023-26001/): WordPress Next Event Calendar <= 1.2 - Cross Site Scripting (XSS) Vulnerability (medium 5.9)
- [CVE-2023-26000](https://insights.sbomify.com/CVE-2023-26000/): WordPress Bang tinh vay <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (medium 5.9)
- [CVE-2023-2600](https://insights.sbomify.com/CVE-2023-2600/): Custom Base Terms < 1.0.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-25999](https://insights.sbomify.com/CVE-2023-25999/): WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability (high 8.1)
- [CVE-2023-25998](https://insights.sbomify.com/CVE-2023-25998/): WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability (high 8.1)
- [CVE-2023-25997](https://insights.sbomify.com/CVE-2023-25997/): WordPress Sola Support Ticket <= 3.17 - Arbitrary Content Deletion Vulnerability (medium 6.5)
- [CVE-2023-25996](https://insights.sbomify.com/CVE-2023-25996/): Information disclosure in Booster Elite for WooCommerce (medium 6.5)
- [CVE-2023-25995](https://insights.sbomify.com/CVE-2023-25995/): WordPress AI Mortgage Calculator <= 1.0.1 - Local File Inclusion Vulnerability (high 7.5)
- [CVE-2023-25994](https://insights.sbomify.com/CVE-2023-25994/): WordPress Publish to Schedule Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25993](https://insights.sbomify.com/CVE-2023-25993/): WordPress Top 10 – Popular posts plugin for WordPress plugin <= 3.2.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-25992](https://insights.sbomify.com/CVE-2023-25992/): WordPress CM Answers Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25991](https://insights.sbomify.com/CVE-2023-25991/): WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25990](https://insights.sbomify.com/CVE-2023-25990/): WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection (high 7.1)
- [CVE-2023-2599](https://insights.sbomify.com/CVE-2023-2599/): Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection (low 3.1)
- [CVE-2023-25989](https://insights.sbomify.com/CVE-2023-25989/): Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks (medium 4.3)
- [CVE-2023-25988](https://insights.sbomify.com/CVE-2023-25988/): WordPress Video Gallery – YouTube Gallery plugin <= 1.7.6 - Broken Access Control vulnerability (high 7.5)
- [CVE-2023-25987](https://insights.sbomify.com/CVE-2023-25987/): WordPress YouTube Channel Plugin <= 3.23.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25986](https://insights.sbomify.com/CVE-2023-25986/): WordPress PayGreen Plugin <= 4.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25985](https://insights.sbomify.com/CVE-2023-25985/): WordPress WordPress Tooltips Plugin <= 8.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25984](https://insights.sbomify.com/CVE-2023-25984/): WordPress Dovetail Plugin <= 1.2.13 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25983](https://insights.sbomify.com/CVE-2023-25983/): WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection (high 8.8)
- [CVE-2023-25982](https://insights.sbomify.com/CVE-2023-25982/): WordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-25981](https://insights.sbomify.com/CVE-2023-25981/): WordPress BuddyForms Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-25980](https://insights.sbomify.com/CVE-2023-25980/): WordPress Optimize Database after Deleting Revisions Plugin <= 5.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-2598](https://insights.sbomify.com/CVE-2023-2598/): Memory corruption in Kernel (high 7.8)
- [CVE-2023-25979](https://insights.sbomify.com/CVE-2023-25979/): WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25978](https://insights.sbomify.com/CVE-2023-25978/): WordPress Protected Posts Logout Button Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25977](https://insights.sbomify.com/CVE-2023-25977/): WordPress CPT – Speakers Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25976](https://insights.sbomify.com/CVE-2023-25976/): Cross-site request forgery in Integration for Contact Form 7 and Zoho CRM, Bigin (medium 4.3)
- [CVE-2023-25975](https://insights.sbomify.com/CVE-2023-25975/): WordPress Etsy Shop Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25974](https://insights.sbomify.com/CVE-2023-25974/): WordPress wp2syslog Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25973](https://insights.sbomify.com/CVE-2023-25973/): WordPress Auto Affiliate Links Plugin <= 6.3.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25972](https://insights.sbomify.com/CVE-2023-25972/): WordPress Старт Plugin <= 3.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25971](https://insights.sbomify.com/CVE-2023-25971/): Cross-site request forgery in Educare (medium 4.3)
- [CVE-2023-25970](https://insights.sbomify.com/CVE-2023-25970/): WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-2597](https://insights.sbomify.com/CVE-2023-2597/): Memory corruption in Eclipse OpenJ9 (high 7.0)
- [CVE-2023-25969](https://insights.sbomify.com/CVE-2023-25969/): WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-25968](https://insights.sbomify.com/CVE-2023-25968/): Cross-site request forgery in Client Portal – Private user pages and login (medium 4.3)
- [CVE-2023-25967](https://insights.sbomify.com/CVE-2023-25967/): WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25966](https://insights.sbomify.com/CVE-2023-25966/): WordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerability (medium 5.5)
- [CVE-2023-25965](https://insights.sbomify.com/CVE-2023-25965/): WordPress Upload Resume plugin <= 1.2.0 - Sensitive Data Exposure vulnerability (medium 5.9)
- [CVE-2023-25964](https://insights.sbomify.com/CVE-2023-25964/): WordPress We’re Open! Plugin <= 1.46 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25963](https://insights.sbomify.com/CVE-2023-25963/): WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25962](https://insights.sbomify.com/CVE-2023-25962/): WordPress Accordions Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25961](https://insights.sbomify.com/CVE-2023-25961/): WordPress Darcie Theme <= 1.1.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-25960](https://insights.sbomify.com/CVE-2023-25960/): WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to SQL Injection (critical 10.0)
- [CVE-2023-2596](https://insights.sbomify.com/CVE-2023-2596/): SourceCodester Online Reviewer System GET Parameter user-update.php sql injection (medium 6.3)
- [CVE-2023-25959](https://insights.sbomify.com/CVE-2023-25959/): WordPress Apollo13 Framework Extensions plugin <= 1.8.10 - Broken Access Control (medium 5.4)
- [CVE-2023-25958](https://insights.sbomify.com/CVE-2023-25958/): WordPress Simple Tooltips Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25957](https://insights.sbomify.com/CVE-2023-25957/): Auth bypass in Mendix SAML (Mendix 7 compatible) (critical 9.1)
- [CVE-2023-25956](https://insights.sbomify.com/CVE-2023-25956/): Apache Airflow AWS Provider: Arbitrary file read via AWS provider (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/360/