# Vulnerabilities published in 2023


- [CVE-2023-23688](https://insights.sbomify.com/CVE-2023-23688/): WordPress Social Share Boost Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23687](https://insights.sbomify.com/CVE-2023-23687/): WordPress Youtube shortcode Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23686](https://insights.sbomify.com/CVE-2023-23686/): WordPress Simple Staff List Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23685](https://insights.sbomify.com/CVE-2023-23685/): WordPress Portfolio – WordPress Portfolio Plugin Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23684](https://insights.sbomify.com/CVE-2023-23684/): WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.4)
- [CVE-2023-23683](https://insights.sbomify.com/CVE-2023-23683/): WordPress White Label Branding for Elementor Page Builder Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23682](https://insights.sbomify.com/CVE-2023-23682/): WordPress EZP Maintenance Mode Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23681](https://insights.sbomify.com/CVE-2023-23681/): WordPress Image Hover Effects For WPBakery Page Builder Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23680](https://insights.sbomify.com/CVE-2023-23680/): WordPress WP TopBar Plugin <= 5.36 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-2368](https://insights.sbomify.com/CVE-2023-2368/): SourceCodester Faculty Evaluation System sql injection (medium 4.7)
- [CVE-2023-23679](https://insights.sbomify.com/CVE-2023-23679/): Missing authorization in JS Help Desk (medium 4.6)
- [CVE-2023-23678](https://insights.sbomify.com/CVE-2023-23678/): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection (medium 4.0)
- [CVE-2023-23677](https://insights.sbomify.com/CVE-2023-23677/): WordPress GTmetrix for WordPress Plugin <= 0.4.5 is vulnerable to Cross Site Scripting (XSS) (low 3.8)
- [CVE-2023-23676](https://insights.sbomify.com/CVE-2023-23676/): WordPress File Gallery Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23675](https://insights.sbomify.com/CVE-2023-23675/): WordPress WP Smart Preloader Plugin <= 1.15 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23674](https://insights.sbomify.com/CVE-2023-23674/): WordPress WP Original Media Path Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23673](https://insights.sbomify.com/CVE-2023-23673/): WordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23672](https://insights.sbomify.com/CVE-2023-23672/): WordPress GiveWP plugin <= 2.25.1 - Arbitrary Content Deletion vulnerability (medium 5.4)
- [CVE-2023-23671](https://insights.sbomify.com/CVE-2023-23671/): WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-23670](https://insights.sbomify.com/CVE-2023-23670/): WordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-2367](https://insights.sbomify.com/CVE-2023-2367/): SourceCodester Faculty Evaluation System manage_academic.php sql injection (medium 4.7)
- [CVE-2023-23668](https://insights.sbomify.com/CVE-2023-23668/): WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23667](https://insights.sbomify.com/CVE-2023-23667/): WordPress Brands for WooCommerce Plugin <= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23664](https://insights.sbomify.com/CVE-2023-23664/): WordPress ConvertBox Auto Embed WordPress plugin Plugin <= 1.0.19 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23660](https://insights.sbomify.com/CVE-2023-23660/): WordPress MainWP Maintenance Extension Plugin <= 4.1.1 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-2366](https://insights.sbomify.com/CVE-2023-2366/): SourceCodester Faculty Evaluation System sql injection (medium 6.3)
- [CVE-2023-23659](https://insights.sbomify.com/CVE-2023-23659/): WordPress MainWP Matomo Extension Plugin <= 4.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23657](https://insights.sbomify.com/CVE-2023-23657/): WordPress Mail Subscribe List Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23656](https://insights.sbomify.com/CVE-2023-23656/): WordPress MainWP File Uploader Extension Plugin <= 4.1 - Unauthenticated Arbitrary File Upload Vulnerability (critical 10.0)
- [CVE-2023-23654](https://insights.sbomify.com/CVE-2023-23654/): WordPress SparkPost Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23651](https://insights.sbomify.com/CVE-2023-23651/): WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2023-23650](https://insights.sbomify.com/CVE-2023-23650/): WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-2365](https://insights.sbomify.com/CVE-2023-2365/): SourceCodester Faculty Evaluation System sql injection (medium 6.3)
- [CVE-2023-23649](https://insights.sbomify.com/CVE-2023-23649/): WordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection Vulnerability (high 8.1)
- [CVE-2023-23647](https://insights.sbomify.com/CVE-2023-23647/): WordPress Team Member Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23646](https://insights.sbomify.com/CVE-2023-23646/): WordPress Album Gallery – WordPress Gallery Plugin <= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23645](https://insights.sbomify.com/CVE-2023-23645/): Code injection in MainWP Code Snippets Extension (critical 9.9)
- [CVE-2023-23641](https://insights.sbomify.com/CVE-2023-23641/): WordPress Uji Popup Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23640](https://insights.sbomify.com/CVE-2023-23640/): WordPress MainWP UpdraftPlus Extension Plugin <= 4.0.6 - Subscriber+ Arbitrary Plugin Activation Vulnerability (medium 5.4)
- [CVE-2023-2364](https://insights.sbomify.com/CVE-2023-2364/): SourceCodester Resort Reservation System registration.php cross site scripting (medium 4.3)
- [CVE-2023-23639](https://insights.sbomify.com/CVE-2023-23639/): WordPress MainWP Staging Extension Plugin <= 4.0.3 - Subscriber+ Arbitrary Plugin Activation Vulnerability (medium 5.4)
- [CVE-2023-23638](https://insights.sbomify.com/CVE-2023-23638/): Apache Dubbo Deserialization Vulnerability Gadgets Bypass (medium 5.0)
- [CVE-2023-23637](https://insights.sbomify.com/CVE-2023-23637/): Cross-site scripting in unistra:impatient (high 7.6)
- [CVE-2023-23636](https://insights.sbomify.com/CVE-2023-23636/): Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name (medium 5.4)
- [CVE-2023-23635](https://insights.sbomify.com/CVE-2023-23635/): Jellyfin Web Cross-Site Scripting (XSS) via Collection Name (medium 5.4)
- [CVE-2023-23634](https://insights.sbomify.com/CVE-2023-23634/): SQL injection in documize:documize (critical 9.8)
- [CVE-2023-23632](https://insights.sbomify.com/CVE-2023-23632/): Auth bypass in beyondtrust:privileged remote access (high 7.8)
- [CVE-2023-23631](https://insights.sbomify.com/CVE-2023-23631/): HAMT Decoding Panics in github.com/ipfs/go-unixfsnode (medium 5.9)
- [CVE-2023-23630](https://insights.sbomify.com/CVE-2023-23630/): Cross-site (XSS) vulnerability with Express API in Eta (high 8.6)
- [CVE-2023-2363](https://insights.sbomify.com/CVE-2023-2363/): SourceCodester Resort Reservation System view_room.php sql injection (medium 6.3)
- [CVE-2023-23629](https://insights.sbomify.com/CVE-2023-23629/): Metabase subject to Improper Privilege Management (medium 6.3)
- [CVE-2023-23628](https://insights.sbomify.com/CVE-2023-23628/): Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor (medium 5.7)
- [CVE-2023-23627](https://insights.sbomify.com/CVE-2023-23627/): Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element (medium 6.1)
- [CVE-2023-23626](https://insights.sbomify.com/CVE-2023-23626/): Denial of service when feeding malformed size arguments in go-bitfield (medium 5.9)
- [CVE-2023-23625](https://insights.sbomify.com/CVE-2023-23625/): Denial of service in HAMT Decoding in go-unixfs (medium 5.9)
- [CVE-2023-23624](https://insights.sbomify.com/CVE-2023-23624/): Discourse's exclude_tags param could leak which topics had a specific hidden tag (medium 4.3)
- [CVE-2023-23623](https://insights.sbomify.com/CVE-2023-23623/): Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron (high 7.5)
- [CVE-2023-23622](https://insights.sbomify.com/CVE-2023-23622/): Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users (medium 4.3)
- [CVE-2023-23621](https://insights.sbomify.com/CVE-2023-23621/): Discourse vulnerable to ReDoS in user agent parsing (high 8.6)
- [CVE-2023-23620](https://insights.sbomify.com/CVE-2023-23620/): Discourse restricted tag routes leak topic information (medium 5.3)
- [CVE-2023-2362](https://insights.sbomify.com/CVE-2023-2362/): Multiple Plugins from Wow-Company - Reflected XSS (medium 6.1)
- [CVE-2023-23619](https://insights.sbomify.com/CVE-2023-23619/): Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina (critical 10.0)
- [CVE-2023-23618](https://insights.sbomify.com/CVE-2023-23618/): gitk can inadvertently call executables in the worktree (high 8.6)
- [CVE-2023-23617](https://insights.sbomify.com/CVE-2023-23617/): OpenMage LTS has DoS vulnerability in MaliciousCode filter (medium 4.9)
- [CVE-2023-23616](https://insights.sbomify.com/CVE-2023-23616/): Discourse membership requests lack character limit (low 3.5)
- [CVE-2023-23615](https://insights.sbomify.com/CVE-2023-23615/): Malicious users in Discourse can create spam topics as any user due to improper access control (medium 5.3)
- [CVE-2023-23614](https://insights.sbomify.com/CVE-2023-23614/): Improper session handling of "Remember me for 7 days" functionality (high 8.8)
- [CVE-2023-23613](https://insights.sbomify.com/CVE-2023-23613/): Field-level security issue with .keyword fields in OpenSearch (medium 5.7)
- [CVE-2023-23612](https://insights.sbomify.com/CVE-2023-23612/): Issue with whitespace in JWT roles in OpenSearch (medium 4.7)
- [CVE-2023-23611](https://insights.sbomify.com/CVE-2023-23611/): xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation (medium 5.4)
- [CVE-2023-23610](https://insights.sbomify.com/CVE-2023-23610/): glpi vulnerable to Unauthorized access to data export (medium 6.5)
- [CVE-2023-2361](https://insights.sbomify.com/CVE-2023-2361/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.3)
- [CVE-2023-23609](https://insights.sbomify.com/CVE-2023-23609/): contiki-ng BLE-L2CAP contains Improper size validation of L2CAP frames (high 8.2)
- [CVE-2023-23608](https://insights.sbomify.com/CVE-2023-23608/): spotipy Path traversal vulnerability that may lead to type confusion in URI handling code (not scored)
- [CVE-2023-23607](https://insights.sbomify.com/CVE-2023-23607/): Unrestricted file upload leads to Remote Code Execution in erohtar/Dasherr (critical 9.8)
- [CVE-2023-23606](https://insights.sbomify.com/CVE-2023-23606/): Memory safety bugs fixed in Firefox 109 (high 8.8)
- [CVE-2023-23605](https://insights.sbomify.com/CVE-2023-23605/): Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (high 8.8)
- [CVE-2023-23604](https://insights.sbomify.com/CVE-2023-23604/): Creation of duplicate SystemPrincipal from less secure contexts (medium 6.5)
- [CVE-2023-23603](https://insights.sbomify.com/CVE-2023-23603/): Calls to console.log allowed bypassing Content Security Policy via format directive (medium 6.5)
- [CVE-2023-23602](https://insights.sbomify.com/CVE-2023-23602/): Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers (medium 6.5)
- [CVE-2023-23601](https://insights.sbomify.com/CVE-2023-23601/): URL being dragged from cross-origin iframe into same tab triggers navigation (medium 6.5)
- [CVE-2023-23600](https://insights.sbomify.com/CVE-2023-23600/): Notification permissions persisted between Normal and Private Browsing on Android (medium 6.5)
- [CVE-2023-2360](https://insights.sbomify.com/CVE-2023-2360/): Misconfiguration in Acronis Cyber Infrastructure (low 3.1)
- [CVE-2023-23599](https://insights.sbomify.com/CVE-2023-23599/): Malicious command could be hidden in devtools output on Windows (medium 6.5)
- [CVE-2023-23598](https://insights.sbomify.com/CVE-2023-23598/): Arbitrary file read from GTK drag and drop on Linux (medium 6.5)
- [CVE-2023-23597](https://insights.sbomify.com/CVE-2023-23597/): Logic bug in process allocation allowed to read arbitrary files (medium 6.5)
- [CVE-2023-23596](https://insights.sbomify.com/CVE-2023-23596/): Command injection in jc21:nginx proxy manager (high 8.8)
- [CVE-2023-23595](https://insights.sbomify.com/CVE-2023-23595/): XML external entity in bluecatnetworks:device registration portal (high 7.5)
- [CVE-2023-23594](https://insights.sbomify.com/CVE-2023-23594/): Auth bypass in sato-global:cl4nx plus firmware (critical 9.8)
- [CVE-2023-23592](https://insights.sbomify.com/CVE-2023-23592/): Information disclosure in wallix:bastion access manager (high 7.5)
- [CVE-2023-23591](https://insights.sbomify.com/CVE-2023-23591/): Information disclosure in terminalfour:terminalfour (medium 4.9)
- [CVE-2023-23590](https://insights.sbomify.com/CVE-2023-23590/): Denial of service in mercedes-benz:xentry retail data storage firmware (high 7.5)
- [CVE-2023-2359](https://insights.sbomify.com/CVE-2023-2359/): Revolution Slider <= 6.6.12 - Author+ Remote Code Execution (high 8.8)
- [CVE-2023-23589](https://insights.sbomify.com/CVE-2023-23589/): Security feature bypass in debian:debian linux (medium 6.5)
- [CVE-2023-23588](https://insights.sbomify.com/CVE-2023-23588/): Weak cryptography in SIMATIC IPC1047 (medium 6.2)
- [CVE-2023-23586](https://insights.sbomify.com/CVE-2023-23586/): Use after free in io_uring in the Linux Kernel (medium 5.5)
- [CVE-2023-23585](https://insights.sbomify.com/CVE-2023-23585/): Server DoS due to heap overflow (critical 9.8)
- [CVE-2023-23584](https://insights.sbomify.com/CVE-2023-23584/): Information disclosure in Command Centre Server (medium 4.3)
- [CVE-2023-23583](https://insights.sbomify.com/CVE-2023-23583/): Privilege escalation in Intel(R) Processors (high 8.8)
- [CVE-2023-23582](https://insights.sbomify.com/CVE-2023-23582/): Memory corruption in Wattbox WB-300-IP-3 (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/380/