# Vulnerabilities published in 2023


- [CVE-2023-1497](https://insights.sbomify.com/CVE-2023-1497/): SourceCodester Simple and Nice Shopping Cart Script uploaderm.php unrestricted upload (medium 6.3)
- [CVE-2023-1496](https://insights.sbomify.com/CVE-2023-1496/): Cross-site Scripting (XSS) - Reflected in imgproxy/imgproxy (medium 6.5)
- [CVE-2023-1495](https://insights.sbomify.com/CVE-2023-1495/): Rebuild list queryListOfConfig sql injection (medium 6.3)
- [CVE-2023-1494](https://insights.sbomify.com/CVE-2023-1494/): IBOS ApiController.php sql injection (medium 6.3)
- [CVE-2023-1493](https://insights.sbomify.com/CVE-2023-1493/): Max Secure Anti Virus Plus IoControlCode MaxProctetor64.sys 0x220019 denial of service (medium 5.5)
- [CVE-2023-1492](https://insights.sbomify.com/CVE-2023-1492/): Max Secure Anti Virus Plus IoControlCode MaxProc64.sys 0x220019 denial of service (medium 5.5)
- [CVE-2023-1491](https://insights.sbomify.com/CVE-2023-1491/): Max Secure Anti Virus Plus IoControlCode MaxCryptMon.sys 0x220020 access control (medium 4.4)
- [CVE-2023-1490](https://insights.sbomify.com/CVE-2023-1490/): Max Secure Anti Virus Plus IoControlCode SDActMon.sys 0x220020 access control (medium 4.4)
- [CVE-2023-1489](https://insights.sbomify.com/CVE-2023-1489/): Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C402088 access control (high 7.8)
- [CVE-2023-1488](https://insights.sbomify.com/CVE-2023-1488/): Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C40A0E0 denial of service (low 3.3)
- [CVE-2023-1487](https://insights.sbomify.com/CVE-2023-1487/): Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C40A0E0 denial of service (medium 5.5)
- [CVE-2023-1486](https://insights.sbomify.com/CVE-2023-1486/): Lespeed WiseCleaner Wise Force Deleter IoControlCode WiseUnlock64.sys 0x220004 access control (medium 4.4)
- [CVE-2023-1485](https://insights.sbomify.com/CVE-2023-1485/): SourceCodester Young Entrepreneur E-Negosyo System GET Parameter index.php cross site scripting (low 3.5)
- [CVE-2023-1484](https://insights.sbomify.com/CVE-2023-1484/): xzjie cms upload unrestricted upload (medium 6.3)
- [CVE-2023-1483](https://insights.sbomify.com/CVE-2023-1483/): XiaoBingBy TeaCMS getallarticleinfo sql injection (medium 6.3)
- [CVE-2023-1482](https://insights.sbomify.com/CVE-2023-1482/): HkCms External Plugin code injection (medium 4.7)
- [CVE-2023-1481](https://insights.sbomify.com/CVE-2023-1481/): SourceCodester Monitoring of Students Cyber Accounts System POST Parameter cross site scripting (low 3.5)
- [CVE-2023-1480](https://insights.sbomify.com/CVE-2023-1480/): SourceCodester Monitoring of Students Cyber Accounts System POST Parameter login.php sql injection (medium 6.3)
- [CVE-2023-1479](https://insights.sbomify.com/CVE-2023-1479/): SourceCodester Simple Music Player save_music.php unrestricted upload (medium 6.3)
- [CVE-2023-1478](https://insights.sbomify.com/CVE-2023-1478/): Hummingbird < 3.4.2 - Unauthenticated Path Traversal (critical 9.8)
- [CVE-2023-1477](https://insights.sbomify.com/CVE-2023-1477/): Auth bypass in Keycloak Authenticator Extension (high 7.2)
- [CVE-2023-1476](https://insights.sbomify.com/CVE-2023-1476/): Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222 (high 7.0)
- [CVE-2023-1475](https://insights.sbomify.com/CVE-2023-1475/): SourceCodester Canteen Management System createuser.php query sql injection (medium 6.3)
- [CVE-2023-1474](https://insights.sbomify.com/CVE-2023-1474/): SourceCodester Automatic Question Paper Generator System GET Parameter manage_question_paper.php sql injection (medium 6.3)
- [CVE-2023-1473](https://insights.sbomify.com/CVE-2023-1473/): Responsive WordPress Slideshows 3.29.0 - Reflected XSS (medium 6.1)
- [CVE-2023-1472](https://insights.sbomify.com/CVE-2023-1472/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery (medium 6.3)
- [CVE-2023-1471](https://insights.sbomify.com/CVE-2023-1471/): WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection (high 8.8)
- [CVE-2023-1470](https://insights.sbomify.com/CVE-2023-1470/): eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-1469](https://insights.sbomify.com/CVE-2023-1469/): Cross-site scripting in WP Express Checkout (Accept PayPal Payments Easily) (medium 4.4)
- [CVE-2023-1468](https://insights.sbomify.com/CVE-2023-1468/): SourceCodester Student Study Center Desk Management System Report sql injection (medium 6.3)
- [CVE-2023-1467](https://insights.sbomify.com/CVE-2023-1467/): SourceCodester Student Study Center Desk Management System POST Parameter path traversal (medium 6.5)
- [CVE-2023-1466](https://insights.sbomify.com/CVE-2023-1466/): SourceCodester Student Study Center Desk Management System view_student sql injection (medium 6.3)
- [CVE-2023-1465](https://insights.sbomify.com/CVE-2023-1465/): WP EasyPay < 4.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-1464](https://insights.sbomify.com/CVE-2023-1464/): SourceCodester Medicine Tracker System improper authentication (high 7.3)
- [CVE-2023-1463](https://insights.sbomify.com/CVE-2023-1463/): Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass (medium 6.3)
- [CVE-2023-1462](https://insights.sbomify.com/CVE-2023-1462/): IDOR in Digikent (high 8.8)
- [CVE-2023-1461](https://insights.sbomify.com/CVE-2023-1461/): SourceCodester Canteen Management System createCategories.php query sql injection (medium 6.3)
- [CVE-2023-1460](https://insights.sbomify.com/CVE-2023-1460/): SourceCodester Online Pizza Ordering System Password Change improper authentication (medium 6.5)
- [CVE-2023-1459](https://insights.sbomify.com/CVE-2023-1459/): SourceCodester Canteen Management System changeUsername.php sql injection (medium 6.3)
- [CVE-2023-1458](https://insights.sbomify.com/CVE-2023-1458/): Command injection in EdgeRouter X (high 7.2)
- [CVE-2023-1457](https://insights.sbomify.com/CVE-2023-1457/): Command injection in EdgeRouter X (high 7.2)
- [CVE-2023-1456](https://insights.sbomify.com/CVE-2023-1456/): Command injection in EdgeRouter X (high 7.2)
- [CVE-2023-1455](https://insights.sbomify.com/CVE-2023-1455/): SourceCodester Online Pizza Ordering System Login Page sql injection (medium 5.6)
- [CVE-2023-1454](https://insights.sbomify.com/CVE-2023-1454/): jeecg-boot qurestSql sql injection (medium 6.3)
- [CVE-2023-1453](https://insights.sbomify.com/CVE-2023-1453/): Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access control (medium 4.4)
- [CVE-2023-1452](https://insights.sbomify.com/CVE-2023-1452/): GPAC load_text.c buffer overflow (medium 5.3)
- [CVE-2023-1451](https://insights.sbomify.com/CVE-2023-1451/): MP4v2 mp4track.cpp GetSampleFileOffset denial of service (low 3.3)
- [CVE-2023-1450](https://insights.sbomify.com/CVE-2023-1450/): MP4v2 mp4trackdump.cpp DumpTrack denial of service (low 3.3)
- [CVE-2023-1449](https://insights.sbomify.com/CVE-2023-1449/): GPAC av_parsers.c gf_av1_reset_state double free (medium 5.3)
- [CVE-2023-1448](https://insights.sbomify.com/CVE-2023-1448/): GPAC mpegts.c gf_m2ts_process_sdt heap-based overflow (medium 5.3)
- [CVE-2023-1447](https://insights.sbomify.com/CVE-2023-1447/): SourceCodester Medicine Tracker System cross site scripting (low 3.5)
- [CVE-2023-1446](https://insights.sbomify.com/CVE-2023-1446/): Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 denial of service (medium 5.5)
- [CVE-2023-1445](https://insights.sbomify.com/CVE-2023-1445/): Filseclab Twister Antivirus IoControlCode fildds.sys 0x80112053 denial of service (low 3.3)
- [CVE-2023-1444](https://insights.sbomify.com/CVE-2023-1444/): Filseclab Twister Antivirus IoControlCode fildds.sys 0x8011206B denial of service (high 7.5)
- [CVE-2023-1443](https://insights.sbomify.com/CVE-2023-1443/): Filseclab Twister Antivirus IoControlCode fildds.sys 0x80112053 denial of service (medium 6.5)
- [CVE-2023-1442](https://insights.sbomify.com/CVE-2023-1442/): Meizhou Qingyunke QYKCMS Update api.php unrestricted upload (medium 4.7)
- [CVE-2023-1441](https://insights.sbomify.com/CVE-2023-1441/): SourceCodester Automatic Question Paper Generator System GET Parameter view_course.php sql injection (medium 6.3)
- [CVE-2023-1440](https://insights.sbomify.com/CVE-2023-1440/): SourceCodester Automatic Question Paper Generator System GET Parameter manage_user.php sql injection (medium 6.3)
- [CVE-2023-1439](https://insights.sbomify.com/CVE-2023-1439/): SourceCodester Medicine Tracker System GET Parameter view_details.php sql injection (medium 6.3)
- [CVE-2023-1437](https://insights.sbomify.com/CVE-2023-1437/): CVE-2023-1437 (critical 9.8)
- [CVE-2023-1436](https://insights.sbomify.com/CVE-2023-1436/): Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray (medium 5.9)
- [CVE-2023-1435](https://insights.sbomify.com/CVE-2023-1435/): Ajax Search Lite Pro < 4.26.2 - Multiple Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-1433](https://insights.sbomify.com/CVE-2023-1433/): SourceCodester Gadget Works Online Ordering System Products unrestricted upload (medium 4.7)
- [CVE-2023-1432](https://insights.sbomify.com/CVE-2023-1432/): SourceCodester Online Food Ordering System POST Request access control (high 7.3)
- [CVE-2023-1431](https://insights.sbomify.com/CVE-2023-1431/): Information disclosure in WordPress Simple Shopping Cart (medium 5.3)
- [CVE-2023-1430](https://insights.sbomify.com/CVE-2023-1430/): FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control (medium 6.5)
- [CVE-2023-1429](https://insights.sbomify.com/CVE-2023-1429/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 4.0)
- [CVE-2023-1428](https://insights.sbomify.com/CVE-2023-1428/): Denial-of-Service in gRPC (high 7.5)
- [CVE-2023-1427](https://insights.sbomify.com/CVE-2023-1427/): Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal (medium 4.9)
- [CVE-2023-1426](https://insights.sbomify.com/CVE-2023-1426/): WP Tiles <= 1.1.2 - Subscriber+ Draft/Private Post Title Disclosure (medium 6.5)
- [CVE-2023-1425](https://insights.sbomify.com/CVE-2023-1425/): Groundhogg Contacts < 2.7.9.4 - Admin+ SQLi (high 7.2)
- [CVE-2023-1424](https://insights.sbomify.com/CVE-2023-1424/): Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module (critical 10.0)
- [CVE-2023-1421](https://insights.sbomify.com/CVE-2023-1421/): Reflected XSS in OAuth flow completion endpoints (low 3.5)
- [CVE-2023-1420](https://insights.sbomify.com/CVE-2023-1420/): Ajax Search Lite < 4.11.1, Pro < 4.26.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-1419](https://insights.sbomify.com/CVE-2023-1419/): Debezium: script injection via connector parameter (medium 5.9)
- [CVE-2023-1418](https://insights.sbomify.com/CVE-2023-1418/): SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter cashconfirm.php cross site scripting (low 3.5)
- [CVE-2023-1417](https://insights.sbomify.com/CVE-2023-1417/): Missing authorization in GitLab (medium 4.3)
- [CVE-2023-1416](https://insights.sbomify.com/CVE-2023-1416/): Simple Art Gallery adminHome.php sql injection (medium 6.3)
- [CVE-2023-1415](https://insights.sbomify.com/CVE-2023-1415/): Simple Art Gallery adminHome.php sliderPicSubmit unrestricted upload (medium 6.3)
- [CVE-2023-1414](https://insights.sbomify.com/CVE-2023-1414/): WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update (medium 4.3)
- [CVE-2023-1413](https://insights.sbomify.com/CVE-2023-1413/): WP VR < 8.2.9 - Reflected XSS (medium 6.1)
- [CVE-2023-1412](https://insights.sbomify.com/CVE-2023-1412/): Local Privilege Escalation Vulnerability in WARP's MSI Installer (high 7.0)
- [CVE-2023-1410](https://insights.sbomify.com/CVE-2023-1410/): Stored XSS in Graphite FunctionDescription tooltip (medium 6.2)
- [CVE-2023-1409](https://insights.sbomify.com/CVE-2023-1409/): Certificate validation issue in MongoDB Server running on Windows or macOS (medium 5.3)
- [CVE-2023-1408](https://insights.sbomify.com/CVE-2023-1408/): Video List Manager <= 1.7 - Admin+ SQL Injection (high 7.2)
- [CVE-2023-1407](https://insights.sbomify.com/CVE-2023-1407/): SourceCodester Student Study Center Desk Management System manage_user.php sql injection (medium 4.7)
- [CVE-2023-1406](https://insights.sbomify.com/CVE-2023-1406/): JetEngine < 3.1.3.1 - Author+ Remote Code Execution (high 8.8)
- [CVE-2023-1405](https://insights.sbomify.com/CVE-2023-1405/): Formidable Forms < 6.2 - Unauthenticated PHP Object Injection (high 7.5)
- [CVE-2023-1404](https://insights.sbomify.com/CVE-2023-1404/): Weaver Show Posts <= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name (medium 6.4)
- [CVE-2023-1403](https://insights.sbomify.com/CVE-2023-1403/): Weaver Xtreme Theme <= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name (medium 6.4)
- [CVE-2023-1402](https://insights.sbomify.com/CVE-2023-1402/): Moodle: course participation report shows roles the user should not see (medium 4.3)
- [CVE-2023-1401](https://insights.sbomify.com/CVE-2023-1401/): Insertion of Sensitive Information Into Sent Data in GitLab (medium 5.0)
- [CVE-2023-1400](https://insights.sbomify.com/CVE-2023-1400/): Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1399](https://insights.sbomify.com/CVE-2023-1399/): Deserialization in N6854A Geolocation Server (high 7.8)
- [CVE-2023-1398](https://insights.sbomify.com/CVE-2023-1398/): XiaoBingBy TeaCMS upload path traversal (medium 6.3)
- [CVE-2023-1397](https://insights.sbomify.com/CVE-2023-1397/): SourceCodester Online Student Management System profile.php cross site scripting (low 3.5)
- [CVE-2023-1396](https://insights.sbomify.com/CVE-2023-1396/): SourceCodester Online Tours & Travels Management System traveller_details.php cross site scripting (low 3.5)
- [CVE-2023-1395](https://insights.sbomify.com/CVE-2023-1395/): SourceCodester Yoga Class Registration System list.php query cross site scripting (low 3.5)
- [CVE-2023-1394](https://insights.sbomify.com/CVE-2023-1394/): SourceCodester Online Graduate Tracer System bsitemp.php mysqli_query sql injection (medium 6.3)
- [CVE-2023-1393](https://insights.sbomify.com/CVE-2023-1393/): Use after free in xorg-server (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/416/