# Vulnerabilities published in 2023


- [CVE-2023-23791](https://insights.sbomify.com/CVE-2023-23791/): WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23790](https://insights.sbomify.com/CVE-2023-23790/): WordPress Pods Plugin <= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-2379](https://insights.sbomify.com/CVE-2023-2379/): Ubiquiti EdgeRouter X Web Service denial of service (high 7.5)
- [CVE-2023-23789](https://insights.sbomify.com/CVE-2023-23789/): WordPress Premmerce Redirect Manager Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23788](https://insights.sbomify.com/CVE-2023-23788/): WordPress Custom More Link Complete Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23787](https://insights.sbomify.com/CVE-2023-23787/): WordPress Premmerce Redirect Manager Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23786](https://insights.sbomify.com/CVE-2023-23786/): WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23785](https://insights.sbomify.com/CVE-2023-23785/): WordPress Exquisite PayPal Donation Plugin <= v2.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23784](https://insights.sbomify.com/CVE-2023-23784/): Path traversal in FortiWeb (medium 5.6)
- [CVE-2023-23783](https://insights.sbomify.com/CVE-2023-23783/): Memory corruption in FortiWeb (medium 6.5)
- [CVE-2023-23782](https://insights.sbomify.com/CVE-2023-23782/): Memory corruption in FortiWeb (high 7.1)
- [CVE-2023-23781](https://insights.sbomify.com/CVE-2023-23781/): Memory corruption in FortiWeb (medium 6.1)
- [CVE-2023-23780](https://insights.sbomify.com/CVE-2023-23780/): Memory corruption in FortiWeb (high 7.6)
- [CVE-2023-2378](https://insights.sbomify.com/CVE-2023-2378/): Ubiquiti EdgeRouter X Web Management command injection (high 8.6)
- [CVE-2023-23779](https://insights.sbomify.com/CVE-2023-23779/): Command injection in FortiWeb (medium 6.6)
- [CVE-2023-23778](https://insights.sbomify.com/CVE-2023-23778/): Path traversal in FortiWeb (medium 4.7)
- [CVE-2023-23777](https://insights.sbomify.com/CVE-2023-23777/): Command injection in FortiWeb (high 7.2)
- [CVE-2023-23776](https://insights.sbomify.com/CVE-2023-23776/): Information disclosure in FortiAnalyzer (medium 4.6)
- [CVE-2023-23775](https://insights.sbomify.com/CVE-2023-23775/): SQL injection in FortiSOAR (medium 5.9)
- [CVE-2023-23774](https://insights.sbomify.com/CVE-2023-23774/): Other in EBTS/MBTS Base Radio (high 8.4)
- [CVE-2023-23773](https://insights.sbomify.com/CVE-2023-23773/): Security feature bypass in EBTS/MBTS Base Radio (high 7.2)
- [CVE-2023-23772](https://insights.sbomify.com/CVE-2023-23772/): Security feature bypass in MBTS Site Controller (high 7.2)
- [CVE-2023-23771](https://insights.sbomify.com/CVE-2023-23771/): Hardcoded credentials in MBTS Base Radio (high 8.4)
- [CVE-2023-23770](https://insights.sbomify.com/CVE-2023-23770/): Hardcoded credentials in MBTS Site Controller (critical 9.4)
- [CVE-2023-2377](https://insights.sbomify.com/CVE-2023-2377/): Ubiquiti EdgeRouter X Web Management command injection (high 8.6)
- [CVE-2023-23766](https://insights.sbomify.com/CVE-2023-23766/): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (medium 4.5)
- [CVE-2023-23765](https://insights.sbomify.com/CVE-2023-23765/): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (medium 4.8)
- [CVE-2023-23764](https://insights.sbomify.com/CVE-2023-23764/): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (medium 4.8)
- [CVE-2023-23763](https://insights.sbomify.com/CVE-2023-23763/): Information disclosure in GitHub Enterprise Server leading to private repository leakage (medium 5.3)
- [CVE-2023-23762](https://insights.sbomify.com/CVE-2023-23762/): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (medium 6.5)
- [CVE-2023-23761](https://insights.sbomify.com/CVE-2023-23761/): Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists (high 7.7)
- [CVE-2023-23760](https://insights.sbomify.com/CVE-2023-23760/): Path traversal in GitHub Enterprise Server leading to remote code execution (medium 4.9)
- [CVE-2023-2376](https://insights.sbomify.com/CVE-2023-2376/): Ubiquiti EdgeRouter X Web Management command injection (high 8.6)
- [CVE-2023-23759](https://insights.sbomify.com/CVE-2023-23759/): Denial of service in fizz (high 7.5)
- [CVE-2023-23758](https://insights.sbomify.com/CVE-2023-23758/): Extension - creative-solutions.net - SQLi in Creative Gallery component for Joomla <= 2.2.0 (critical 9.8)
- [CVE-2023-23757](https://insights.sbomify.com/CVE-2023-23757/): Extension - bestaddon.com - SQLi in BA Gallery component for Joomla <= 1.2.0 (critical 9.8)
- [CVE-2023-23756](https://insights.sbomify.com/CVE-2023-23756/): Extension - advcomsys.com - XSS in oneVote component for Joomla <= 1.7.0 (medium 6.1)
- [CVE-2023-23755](https://insights.sbomify.com/CVE-2023-23755/): [20230502] - Core - Bruteforce prevention within the mfa screen (high 7.5)
- [CVE-2023-23754](https://insights.sbomify.com/CVE-2023-23754/): [20230501] - Core - Open Redirect and XSS within the mfa select (medium 6.1)
- [CVE-2023-23753](https://insights.sbomify.com/CVE-2023-23753/): Extension - vi-solutions - Visforms Base Package for Joomla 3 (critical 9.8)
- [CVE-2023-23752](https://insights.sbomify.com/CVE-2023-23752/): Joomla! Improper Access Control (medium 5.3, exploited in the wild)
- [CVE-2023-23751](https://insights.sbomify.com/CVE-2023-23751/): [20230102] - Core - Missing ACL checks for com_actionlogs (medium 4.3)
- [CVE-2023-23750](https://insights.sbomify.com/CVE-2023-23750/): [20230101] - Core - CSRF within post-installation messages (medium 6.3)
- [CVE-2023-2375](https://insights.sbomify.com/CVE-2023-2375/): Ubiquiti EdgeRouter X Web Management command injection (high 8.6)
- [CVE-2023-23749](https://insights.sbomify.com/CVE-2023-23749/): Extension - miniorange - LDAP Integration - LDAP Injection (username) (high 7.5)
- [CVE-2023-2374](https://insights.sbomify.com/CVE-2023-2374/): Ubiquiti EdgeRouter X Web Management command injection (high 8.6)
- [CVE-2023-23738](https://insights.sbomify.com/CVE-2023-23738/): WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email Spoofing Vulnerability (medium 5.3)
- [CVE-2023-23737](https://insights.sbomify.com/CVE-2023-23737/): WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-23735](https://insights.sbomify.com/CVE-2023-23735/): WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email HTML Injection Vulnerability (medium 5.3)
- [CVE-2023-23734](https://insights.sbomify.com/CVE-2023-23734/): WordPress Userlike – WordPress Live Chat plugin Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23733](https://insights.sbomify.com/CVE-2023-23733/): WordPress Lazy Social Comments Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23732](https://insights.sbomify.com/CVE-2023-23732/): WordPress Disqus Conditional Load Plugin <= 11.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23731](https://insights.sbomify.com/CVE-2023-23731/): WordPress WishSuite Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23730](https://insights.sbomify.com/CVE-2023-23730/): WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass Vulnerability (medium 5.3)
- [CVE-2023-2373](https://insights.sbomify.com/CVE-2023-2373/): Ubiquiti EdgeRouter X Web Management command injection (high 8.6)
- [CVE-2023-23729](https://insights.sbomify.com/CVE-2023-23729/): WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability (medium 5.4)
- [CVE-2023-23728](https://insights.sbomify.com/CVE-2023-23728/): WordPress WP Flipclock Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23727](https://insights.sbomify.com/CVE-2023-23727/): Cross-site scripting in Live Chat by Formilla (medium 5.9)
- [CVE-2023-23726](https://insights.sbomify.com/CVE-2023-23726/): WordPress Tickera – WordPress Event Ticketing plugin <= 3.5.1.0 - CSRF Leading To Post Status Change Vulnerability (medium 5.4)
- [CVE-2023-23725](https://insights.sbomify.com/CVE-2023-23725/): WordPress Shortcodes by Angie Makes plugin <= 3.46 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-23724](https://insights.sbomify.com/CVE-2023-23724/): Cross-site request forgery in WP Email Capture (medium 4.3)
- [CVE-2023-23723](https://insights.sbomify.com/CVE-2023-23723/): Cross-site scripting in WP Email Capture (medium 5.9)
- [CVE-2023-23722](https://insights.sbomify.com/CVE-2023-23722/): WordPress WP eBay Product Feeds Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23721](https://insights.sbomify.com/CVE-2023-23721/): WordPress Admin Log Plugin <= 1.50 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23720](https://insights.sbomify.com/CVE-2023-23720/): WordPress Verified Reviews (Avis Vérifiés) Plugin <= 2.3.13 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2372](https://insights.sbomify.com/CVE-2023-2372/): SourceCodester Online DJ Management System cross site scripting (low 2.4)
- [CVE-2023-23719](https://insights.sbomify.com/CVE-2023-23719/): WordPress Premmerce Plugin <= 1.3.17 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-23718](https://insights.sbomify.com/CVE-2023-23718/): WordPress Page Loading Effects Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23717](https://insights.sbomify.com/CVE-2023-23717/): WordPress Portfolio Slideshow Plugin <= 1.13.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23716](https://insights.sbomify.com/CVE-2023-23716/): WordPress Zendesk Support for WordPress plugin <= 1.8.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-23715](https://insights.sbomify.com/CVE-2023-23715/): WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability (medium 5.2)
- [CVE-2023-23714](https://insights.sbomify.com/CVE-2023-23714/): WordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23713](https://insights.sbomify.com/CVE-2023-23713/): WordPress Theme Tweaker Plugin <= 5.20 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23712](https://insights.sbomify.com/CVE-2023-23712/): WordPress User Meta Manager Plugin <= 3.4.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-23711](https://insights.sbomify.com/CVE-2023-23711/): WordPress A2 Optimized WP Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23710](https://insights.sbomify.com/CVE-2023-23710/): Cross-site scripting in WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) (medium 5.9)
- [CVE-2023-2371](https://insights.sbomify.com/CVE-2023-2371/): SourceCodester Online DJ Management System GET Parameter view_details.php sql injection (medium 6.3)
- [CVE-2023-23709](https://insights.sbomify.com/CVE-2023-23709/): WordPress WPJAM Basic Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23708](https://insights.sbomify.com/CVE-2023-23708/): WordPress Visualizer Plugin <= 3.9.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23707](https://insights.sbomify.com/CVE-2023-23707/): Cross-site scripting in Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files (medium 5.9)
- [CVE-2023-23706](https://insights.sbomify.com/CVE-2023-23706/): Cross-site request forgery in WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) (medium 4.3)
- [CVE-2023-23705](https://insights.sbomify.com/CVE-2023-23705/): WordPress Books Gallery Plugin <= 4.4.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23704](https://insights.sbomify.com/CVE-2023-23704/): WordPress Comments Ratings Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23703](https://insights.sbomify.com/CVE-2023-23703/): WordPress Arconix Shortcodes Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23702](https://insights.sbomify.com/CVE-2023-23702/): WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23701](https://insights.sbomify.com/CVE-2023-23701/): WordPress Easy Sign Up Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23700](https://insights.sbomify.com/CVE-2023-23700/): WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability (high 7.6)
- [CVE-2023-2370](https://insights.sbomify.com/CVE-2023-2370/): SourceCodester Online DJ Management System GET Parameter manage_event.php sql injection (medium 6.3)
- [CVE-2023-23699](https://insights.sbomify.com/CVE-2023-23699/): WordPress Progress Bar Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23698](https://insights.sbomify.com/CVE-2023-23698/): Other in Dell Command Update (DCU) (medium 5.5)
- [CVE-2023-23697](https://insights.sbomify.com/CVE-2023-23697/): Path traversal in Dell Command Update (DCU) (medium 4.7)
- [CVE-2023-23696](https://insights.sbomify.com/CVE-2023-23696/): Missing authorization in Dell Command Intel vPro Out of Band (DCIV) (high 7.0)
- [CVE-2023-23695](https://insights.sbomify.com/CVE-2023-23695/): Weak cryptography in Secure Connect Gateway (SCG) 5.0 Appliance - SRS (medium 5.9)
- [CVE-2023-23694](https://insights.sbomify.com/CVE-2023-23694/): Command injection in Dell VxRail HCI (medium 4.7)
- [CVE-2023-23693](https://insights.sbomify.com/CVE-2023-23693/): Command injection in Dell VxRail HCI (medium 6.7)
- [CVE-2023-23692](https://insights.sbomify.com/CVE-2023-23692/): Command injection in Data Domain (high 8.8)
- [CVE-2023-23691](https://insights.sbomify.com/CVE-2023-23691/): Other in Dell PowerVault ME5 (high 8.1)
- [CVE-2023-23690](https://insights.sbomify.com/CVE-2023-23690/): Security feature bypass in Cloud Mobility for Dell Storage (high 7.0)
- [CVE-2023-2369](https://insights.sbomify.com/CVE-2023-2369/): SourceCodester Faculty Evaluation System manage_restriction.php sql injection (medium 4.7)
- [CVE-2023-23689](https://insights.sbomify.com/CVE-2023-23689/): Denial of service in PowerScale OneFS (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/379/