# Vulnerabilities published in 2023


- [CVE-2023-24241](https://insights.sbomify.com/CVE-2023-24241/): SQL injection in forget heart message box project:forget heart message box (critical 9.8)
- [CVE-2023-2424](https://insights.sbomify.com/CVE-2023-2424/): DedeCMS config.php UpDateMemberModCache unrestricted upload (medium 6.3)
- [CVE-2023-24238](https://insights.sbomify.com/CVE-2023-24238/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-24236](https://insights.sbomify.com/CVE-2023-24236/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-24234](https://insights.sbomify.com/CVE-2023-24234/): Cross-site scripting in inventory management system project:inventory management system (medium 4.8)
- [CVE-2023-24233](https://insights.sbomify.com/CVE-2023-24233/): Cross-site scripting in inventory management system project:inventory management system (medium 4.8)
- [CVE-2023-24232](https://insights.sbomify.com/CVE-2023-24232/): Cross-site scripting in inventory management system project:inventory management system (medium 4.8)
- [CVE-2023-24231](https://insights.sbomify.com/CVE-2023-24231/): Cross-site scripting in inventory management system project:inventory management system (medium 4.8)
- [CVE-2023-24230](https://insights.sbomify.com/CVE-2023-24230/): Formwork Cross-site Scripting (XSS) from Page title field (medium 4.8)
- [CVE-2023-2423](https://insights.sbomify.com/CVE-2023-2423/): Rockwell Automation Armor PowerFlex Vulnerable to Denial-Of-Service (high 8.6)
- [CVE-2023-24229](https://insights.sbomify.com/CVE-2023-24229/): Command injection in draytek:vigor2960 firmware (high 7.8)
- [CVE-2023-24221](https://insights.sbomify.com/CVE-2023-24221/): SQL injection in luckyframe:luckyframeweb (critical 9.8)
- [CVE-2023-24220](https://insights.sbomify.com/CVE-2023-24220/): SQL injection in luckyframe:luckyframeweb (critical 9.8)
- [CVE-2023-2422](https://insights.sbomify.com/CVE-2023-2422/): Keycloak: oauth client impersonation (medium 5.5)
- [CVE-2023-24219](https://insights.sbomify.com/CVE-2023-24219/): SQL injection in luckyframe:luckyframeweb (critical 9.8)
- [CVE-2023-24217](https://insights.sbomify.com/CVE-2023-24217/): Path traversal in agilebio:electronic lab notebook (high 8.8)
- [CVE-2023-24215](https://insights.sbomify.com/CVE-2023-24215/): Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administr (critical 9.1)
- [CVE-2023-24212](https://insights.sbomify.com/CVE-2023-24212/): Memory corruption in tenda:ax3 firmware (critical 9.8)
- [CVE-2023-2421](https://insights.sbomify.com/CVE-2023-2421/): Control iD RHiD department cross site scripting (low 3.5)
- [CVE-2023-24206](https://insights.sbomify.com/CVE-2023-24206/): SQL injection in davinci project:davinci (critical 9.8)
- [CVE-2023-24205](https://insights.sbomify.com/CVE-2023-24205/): Misconfiguration in clash project:clash (critical 9.8)
- [CVE-2023-24204](https://insights.sbomify.com/CVE-2023-24204/): SQL injection in oretnom23:simple customer relationship management system (medium 5.4)
- [CVE-2023-24203](https://insights.sbomify.com/CVE-2023-24203/): Cross-site scripting in oretnom23:simple customer relationship management system (medium 5.4)
- [CVE-2023-24202](https://insights.sbomify.com/CVE-2023-24202/): Path traversal in oretnom23:raffle draw system (critical 9.8)
- [CVE-2023-24201](https://insights.sbomify.com/CVE-2023-24201/): SQL injection in oretnom23:raffle draw system (critical 9.8)
- [CVE-2023-24200](https://insights.sbomify.com/CVE-2023-24200/): SQL injection in oretnom23:raffle draw system (critical 9.8)
- [CVE-2023-2420](https://insights.sbomify.com/CVE-2023-2420/): MLECMS common.func.php get_url sql injection (medium 6.3)
- [CVE-2023-24199](https://insights.sbomify.com/CVE-2023-24199/): SQL injection in oretnom23:raffle draw system (critical 9.8)
- [CVE-2023-24198](https://insights.sbomify.com/CVE-2023-24198/): SQL injection in oretnom23:raffle draw system (critical 9.8)
- [CVE-2023-24197](https://insights.sbomify.com/CVE-2023-24197/): SQL injection in oretnom23:online food ordering system (medium 6.1)
- [CVE-2023-24195](https://insights.sbomify.com/CVE-2023-24195/): Cross-site scripting in oretnom23:online food ordering system (medium 6.1)
- [CVE-2023-24194](https://insights.sbomify.com/CVE-2023-24194/): Cross-site scripting in oretnom23:online food ordering system (medium 6.1)
- [CVE-2023-24192](https://insights.sbomify.com/CVE-2023-24192/): Cross-site scripting in oretnom23:online food ordering system (medium 6.1)
- [CVE-2023-24191](https://insights.sbomify.com/CVE-2023-24191/): Cross-site scripting in oretnom23:online food ordering system (medium 6.1)
- [CVE-2023-2419](https://insights.sbomify.com/CVE-2023-2419/): Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload (medium 4.7)
- [CVE-2023-24189](https://insights.sbomify.com/CVE-2023-24189/): XML external entity in bstek:urule (critical 9.8)
- [CVE-2023-24188](https://insights.sbomify.com/CVE-2023-24188/): Arbitrary file deletion in ureport (critical 9.1)
- [CVE-2023-24187](https://insights.sbomify.com/CVE-2023-24187/): XML External Entity Reference in ureport (high 7.8)
- [CVE-2023-24184](https://insights.sbomify.com/CVE-2023-24184/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-24182](https://insights.sbomify.com/CVE-2023-24182/): Cross-site scripting in openwrt:openwrt (medium 5.4)
- [CVE-2023-24181](https://insights.sbomify.com/CVE-2023-24181/): Cross-site scripting in openwrt:luci (medium 5.4)
- [CVE-2023-24180](https://insights.sbomify.com/CVE-2023-24180/): Integer overflow in libelfin project:libelfin (medium 6.5)
- [CVE-2023-2418](https://insights.sbomify.com/CVE-2023-2418/): Konga Login API random values (low 3.1)
- [CVE-2023-24170](https://insights.sbomify.com/CVE-2023-24170/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-2417](https://insights.sbomify.com/CVE-2023-2417/): ks-soft Advanced Host Monitor rma_active.exe unquoted search path (medium 5.3)
- [CVE-2023-24169](https://insights.sbomify.com/CVE-2023-24169/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-24167](https://insights.sbomify.com/CVE-2023-24167/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-24166](https://insights.sbomify.com/CVE-2023-24166/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-24165](https://insights.sbomify.com/CVE-2023-24165/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-24164](https://insights.sbomify.com/CVE-2023-24164/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2023-24163](https://insights.sbomify.com/CVE-2023-24163/): Dromara hutool vulnerable to SQL Injection (critical 9.8)
- [CVE-2023-24162](https://insights.sbomify.com/CVE-2023-24162/): Dromara Hutool Deserialization of Untrusted Data vulnerability (critical 9.8)
- [CVE-2023-24161](https://insights.sbomify.com/CVE-2023-24161/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24160](https://insights.sbomify.com/CVE-2023-24160/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-2416](https://insights.sbomify.com/CVE-2023-2416/): Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout (medium 5.4)
- [CVE-2023-24159](https://insights.sbomify.com/CVE-2023-24159/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24157](https://insights.sbomify.com/CVE-2023-24157/): Command injection in totolink:t8 firmware (critical 9.8)
- [CVE-2023-24156](https://insights.sbomify.com/CVE-2023-24156/): Command injection in totolink:t8 firmware (critical 9.8)
- [CVE-2023-24155](https://insights.sbomify.com/CVE-2023-24155/): Hardcoded credentials in totolink:t8 firmware (critical 9.8)
- [CVE-2023-24154](https://insights.sbomify.com/CVE-2023-24154/): Command injection in totolink:t8 firmware (critical 9.8)
- [CVE-2023-24153](https://insights.sbomify.com/CVE-2023-24153/): Command injection in totolink:t8 firmware (critical 9.8)
- [CVE-2023-24152](https://insights.sbomify.com/CVE-2023-24152/): Command injection in totolink:t8 firmware (critical 9.8)
- [CVE-2023-24151](https://insights.sbomify.com/CVE-2023-24151/): Command injection in totolink:t8 firmware (critical 9.8)
- [CVE-2023-24150](https://insights.sbomify.com/CVE-2023-24150/): Command injection in totolink:t8 firmware (critical 9.8)
- [CVE-2023-2415](https://insights.sbomify.com/CVE-2023-2415/): Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout (medium 5.4)
- [CVE-2023-24149](https://insights.sbomify.com/CVE-2023-24149/): Hardcoded credentials in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24148](https://insights.sbomify.com/CVE-2023-24148/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24147](https://insights.sbomify.com/CVE-2023-24147/): Hardcoded credentials in totolink:ca300-poe firmware (high 7.5)
- [CVE-2023-24146](https://insights.sbomify.com/CVE-2023-24146/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24145](https://insights.sbomify.com/CVE-2023-24145/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24144](https://insights.sbomify.com/CVE-2023-24144/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24143](https://insights.sbomify.com/CVE-2023-24143/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24142](https://insights.sbomify.com/CVE-2023-24142/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24141](https://insights.sbomify.com/CVE-2023-24141/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24140](https://insights.sbomify.com/CVE-2023-24140/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-2414](https://insights.sbomify.com/CVE-2023-2414/): Missing authorization in Online Booking & Scheduling Calendar for WordPress by vcita (medium 5.4)
- [CVE-2023-24139](https://insights.sbomify.com/CVE-2023-24139/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24138](https://insights.sbomify.com/CVE-2023-24138/): Command injection in totolink:ca300-poe firmware (critical 9.8)
- [CVE-2023-24135](https://insights.sbomify.com/CVE-2023-24135/): Command injection in jensenofscandinavia:eagle 1200ac firmware (high 7.8)
- [CVE-2023-24134](https://insights.sbomify.com/CVE-2023-24134/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24133](https://insights.sbomify.com/CVE-2023-24133/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24132](https://insights.sbomify.com/CVE-2023-24132/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24131](https://insights.sbomify.com/CVE-2023-24131/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24130](https://insights.sbomify.com/CVE-2023-24130/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-2413](https://insights.sbomify.com/CVE-2023-2413/): SourceCodester AC Repair and Services System manage_booking.php sql injection (medium 6.3)
- [CVE-2023-24129](https://insights.sbomify.com/CVE-2023-24129/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24128](https://insights.sbomify.com/CVE-2023-24128/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24127](https://insights.sbomify.com/CVE-2023-24127/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24126](https://insights.sbomify.com/CVE-2023-24126/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24125](https://insights.sbomify.com/CVE-2023-24125/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24124](https://insights.sbomify.com/CVE-2023-24124/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24123](https://insights.sbomify.com/CVE-2023-24123/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24122](https://insights.sbomify.com/CVE-2023-24122/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24121](https://insights.sbomify.com/CVE-2023-24121/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24120](https://insights.sbomify.com/CVE-2023-24120/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-2412](https://insights.sbomify.com/CVE-2023-2412/): SourceCodester AC Repair and Services System manage_user.php sql injection (medium 6.3)
- [CVE-2023-24119](https://insights.sbomify.com/CVE-2023-24119/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24118](https://insights.sbomify.com/CVE-2023-24118/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24117](https://insights.sbomify.com/CVE-2023-24117/): Memory corruption in heimgardtechnologies:eagle 1200ac firmware (medium 6.5)
- [CVE-2023-24114](https://insights.sbomify.com/CVE-2023-24114/): Code injection in typecho:typecho (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/375/