# Vulnerabilities published in 2023


- [CVE-2023-1392](https://insights.sbomify.com/CVE-2023-1392/): SourceCodester Online Pizza Ordering System save_menu unrestricted upload (medium 6.3)
- [CVE-2023-1391](https://insights.sbomify.com/CVE-2023-1391/): SourceCodester Online Tours & Travels Management System ab.php unrestricted upload (medium 4.7)
- [CVE-2023-1390](https://insights.sbomify.com/CVE-2023-1390/): Denial of service in Linux kernel (TIPC kernel module) (high 7.5)
- [CVE-2023-1389](https://insights.sbomify.com/CVE-2023-1389/): TP-Link Archer AX-21 Command Injection (high 8.8, exploited in the wild)
- [CVE-2023-1388](https://insights.sbomify.com/CVE-2023-1388/): Memory corruption in Trellix Agent (medium 6.3)
- [CVE-2023-1387](https://insights.sbomify.com/CVE-2023-1387/): Information disclosure in Grafana (medium 4.2)
- [CVE-2023-1386](https://insights.sbomify.com/CVE-2023-1386/): Qemu: 9pfs: suid/sgid bits not dropped on file write (low 3.3)
- [CVE-2023-1385](https://insights.sbomify.com/CVE-2023-1385/): Weak cryptography in Fire TV Stick 3rd gen (high 7.1)
- [CVE-2023-1384](https://insights.sbomify.com/CVE-2023-1384/): Cross-site scripting in Fire TV Stick 3rd gen (medium 4.3)
- [CVE-2023-1383](https://insights.sbomify.com/CVE-2023-1383/): Missing authorization in Fire TV Stick 3rd gen (medium 5.4)
- [CVE-2023-1382](https://insights.sbomify.com/CVE-2023-1382/): Null dereference in Kernel (medium 4.7)
- [CVE-2023-1381](https://insights.sbomify.com/CVE-2023-1381/): WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization (high 8.8)
- [CVE-2023-1380](https://insights.sbomify.com/CVE-2023-1380/): Memory corruption in Kernel (high 7.1)
- [CVE-2023-1379](https://insights.sbomify.com/CVE-2023-1379/): SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter addmem.php sql injection (medium 6.3)
- [CVE-2023-1378](https://insights.sbomify.com/CVE-2023-1378/): SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter paypalsuccess.php sql injection (medium 6.3)
- [CVE-2023-1377](https://insights.sbomify.com/CVE-2023-1377/): Solidres <= 0.9.4 - Multiple Reflected XSS (medium 6.1)
- [CVE-2023-1375](https://insights.sbomify.com/CVE-2023-1375/): WP Fastest Cache <= 1.1.2 - Missing Authorization to Cache Deletion (medium 4.3)
- [CVE-2023-1374](https://insights.sbomify.com/CVE-2023-1374/): Solidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-1373](https://insights.sbomify.com/CVE-2023-1373/): W4 Post List < 2.4.6 - Reflected XSS (medium 6.1)
- [CVE-2023-1372](https://insights.sbomify.com/CVE-2023-1372/): WH Testimonials <= 3.0.0 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2023-1371](https://insights.sbomify.com/CVE-2023-1371/): W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure (medium 6.5)
- [CVE-2023-1370](https://insights.sbomify.com/CVE-2023-1370/): Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON (high 7.5)
- [CVE-2023-1369](https://insights.sbomify.com/CVE-2023-1369/): TG Soft Vir.IT eXplorer IoControlCode VIRAGTLT.sys 0x82730088 denial of service (medium 5.0)
- [CVE-2023-1368](https://insights.sbomify.com/CVE-2023-1368/): XHCMS POST Parameter login.php sql injection (high 7.3)
- [CVE-2023-1367](https://insights.sbomify.com/CVE-2023-1367/): Code Injection in alextselegidis/easyappointments (medium 6.0)
- [CVE-2023-1366](https://insights.sbomify.com/CVE-2023-1366/): SourceCodester Yoga Class Registration System manage_category.php query sql injection (medium 6.3)
- [CVE-2023-1365](https://insights.sbomify.com/CVE-2023-1365/): SourceCodester Online Pizza Ordering System ajax.php sql injection (high 7.3)
- [CVE-2023-1364](https://insights.sbomify.com/CVE-2023-1364/): SourceCodester Online Pizza Ordering System GET Parameter category.php sql injection (medium 6.3)
- [CVE-2023-1363](https://insights.sbomify.com/CVE-2023-1363/): SourceCodester Computer Parts Sales and Inventory System Add User Account cross site scripting (low 3.5)
- [CVE-2023-1362](https://insights.sbomify.com/CVE-2023-1362/): Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys (high 8.4)
- [CVE-2023-1361](https://insights.sbomify.com/CVE-2023-1361/): SQL Injection in unilogies/bumsys (high 7.2)
- [CVE-2023-1360](https://insights.sbomify.com/CVE-2023-1360/): SourceCodester Employee Payslip Generator with Sending Mail New User Creation sql injection (medium 4.7)
- [CVE-2023-1359](https://insights.sbomify.com/CVE-2023-1359/): SourceCodester Gadget Works Online Ordering System Add New User cross site scripting (low 2.4)
- [CVE-2023-1358](https://insights.sbomify.com/CVE-2023-1358/): SourceCodester Gadget Works Online Ordering System POST Parameter login.php sql injection (medium 6.3)
- [CVE-2023-1357](https://insights.sbomify.com/CVE-2023-1357/): SourceCodester Simple Bakery Shop Management System Admin Login sql injection (high 7.3)
- [CVE-2023-1356](https://insights.sbomify.com/CVE-2023-1356/): Reflected Cross-site Scripting In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-1355](https://insights.sbomify.com/CVE-2023-1355/): NULL Pointer Dereference in vim/vim (high 8.4)
- [CVE-2023-1354](https://insights.sbomify.com/CVE-2023-1354/): SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System register.php cross site scripting (low 3.5)
- [CVE-2023-1353](https://insights.sbomify.com/CVE-2023-1353/): Cross-site scripting in Design and Implementation of Covid-19 Directory on Vaccination System (low 3.5)
- [CVE-2023-1352](https://insights.sbomify.com/CVE-2023-1352/): SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System login.php sql injection (medium 5.6)
- [CVE-2023-1351](https://insights.sbomify.com/CVE-2023-1351/): SourceCodester Computer Parts Sales and Inventory System cust_transac.php sql injection (medium 6.3)
- [CVE-2023-1350](https://insights.sbomify.com/CVE-2023-1350/): liferea Feed Enrichment update.c update_job_run os command injection (medium 6.3)
- [CVE-2023-1349](https://insights.sbomify.com/CVE-2023-1349/): Hsycms Add Category Module cate.php cross site scripting (low 3.5)
- [CVE-2023-1347](https://insights.sbomify.com/CVE-2023-1347/): Customizer Export/Import < 0.9.6 - Admin+ PHP Object Injection (high 7.2)
- [CVE-2023-1346](https://insights.sbomify.com/CVE-2023-1346/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_page_cache' (medium 4.3)
- [CVE-2023-1345](https://insights.sbomify.com/CVE-2023-1345/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'queue_posts' (medium 4.3)
- [CVE-2023-1344](https://insights.sbomify.com/CVE-2023-1344/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'uucss_update_rule' (medium 4.3)
- [CVE-2023-1343](https://insights.sbomify.com/CVE-2023-1343/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'attach_rule' (medium 4.3)
- [CVE-2023-1342](https://insights.sbomify.com/CVE-2023-1342/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ucss_connect' (medium 4.3)
- [CVE-2023-1341](https://insights.sbomify.com/CVE-2023-1341/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ajax_deactivate' (medium 4.3)
- [CVE-2023-1340](https://insights.sbomify.com/CVE-2023-1340/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_uucss_logs' (medium 4.3)
- [CVE-2023-1339](https://insights.sbomify.com/CVE-2023-1339/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'uucss_update_rule' (medium 4.3)
- [CVE-2023-1338](https://insights.sbomify.com/CVE-2023-1338/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'attach_rule' (medium 4.3)
- [CVE-2023-1337](https://insights.sbomify.com/CVE-2023-1337/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_uucss_logs' (medium 4.3)
- [CVE-2023-1336](https://insights.sbomify.com/CVE-2023-1336/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate' (medium 4.3)
- [CVE-2023-1335](https://insights.sbomify.com/CVE-2023-1335/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ucss_connect' (medium 4.3)
- [CVE-2023-1334](https://insights.sbomify.com/CVE-2023-1334/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'queue_posts' (medium 4.3)
- [CVE-2023-1333](https://insights.sbomify.com/CVE-2023-1333/): RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_page_cache' (medium 4.3)
- [CVE-2023-1331](https://insights.sbomify.com/CVE-2023-1331/): Redirection < 1.1.5 - Plugin Reset via CSRF (medium 6.5)
- [CVE-2023-1330](https://insights.sbomify.com/CVE-2023-1330/): Redirection < 1.1.4 - Redirect Creation via CSRF (medium 6.5)
- [CVE-2023-1329](https://insights.sbomify.com/CVE-2023-1329/): Memory corruption in HP multifunction printers (critical 9.8)
- [CVE-2023-1328](https://insights.sbomify.com/CVE-2023-1328/): Guizhou 115cms index unrestricted upload (medium 4.7)
- [CVE-2023-1327](https://insights.sbomify.com/CVE-2023-1327/): Auth bypass in Netgear RAX30 (AX2400) (critical 9.8)
- [CVE-2023-1326](https://insights.sbomify.com/CVE-2023-1326/): local privilege escalation in apport-cli (high 7.7)
- [CVE-2023-1325](https://insights.sbomify.com/CVE-2023-1325/): Easy Forms for MailChimp < 6.8.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-1324](https://insights.sbomify.com/CVE-2023-1324/): Easy Forms for MailChimp < 6.8.8 - Reflected XSS (medium 6.1)
- [CVE-2023-1323](https://insights.sbomify.com/CVE-2023-1323/): Easy Forms for MailChimp < 6.8.9 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1322](https://insights.sbomify.com/CVE-2023-1322/): lmxcms BookAction.class.php reply sql injection (medium 6.3)
- [CVE-2023-1321](https://insights.sbomify.com/CVE-2023-1321/): lmxcms AcquisiAction.class.php update sql injection (medium 6.3)
- [CVE-2023-1320](https://insights.sbomify.com/CVE-2023-1320/): Cross-site Scripting (XSS) - Stored in osticket/osticket (high 7.1)
- [CVE-2023-1319](https://insights.sbomify.com/CVE-2023-1319/): Cross-site Scripting (XSS) - Stored in osticket/osticket (medium 4.8)
- [CVE-2023-1318](https://insights.sbomify.com/CVE-2023-1318/): Cross-site Scripting (XSS) - Generic in osticket/osticket (medium 5.4)
- [CVE-2023-1317](https://insights.sbomify.com/CVE-2023-1317/): Cross-site Scripting (XSS) - Reflected in osticket/osticket (medium 5.4)
- [CVE-2023-1316](https://insights.sbomify.com/CVE-2023-1316/): Cross-site Scripting (XSS) - Stored in osticket/osticket (medium 4.5)
- [CVE-2023-1315](https://insights.sbomify.com/CVE-2023-1315/): Cross-site Scripting (XSS) - Reflected in osticket/osticket (medium 5.4)
- [CVE-2023-1314](https://insights.sbomify.com/CVE-2023-1314/): Local Privilege Escalation Vulnerability in cloudflared's Installer (high 7.5)
- [CVE-2023-1313](https://insights.sbomify.com/CVE-2023-1313/): Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit (high 7.2)
- [CVE-2023-1312](https://insights.sbomify.com/CVE-2023-1312/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 5.2)
- [CVE-2023-1311](https://insights.sbomify.com/CVE-2023-1311/): SourceCodester Friendly Island Pizza Website and Ordering System GET Parameter large.php sql injection (medium 6.3)
- [CVE-2023-1310](https://insights.sbomify.com/CVE-2023-1310/): SourceCodester Online Graduate Tracer System prof.php sql injection (medium 6.3)
- [CVE-2023-1309](https://insights.sbomify.com/CVE-2023-1309/): SourceCodester Online Graduate Tracer System search_it.php sql injection (medium 6.3)
- [CVE-2023-1308](https://insights.sbomify.com/CVE-2023-1308/): SourceCodester Online Graduate Tracer System adminlog.php sql injection (medium 6.3)
- [CVE-2023-1307](https://insights.sbomify.com/CVE-2023-1307/): Authentication Bypass by Primary Weakness in froxlor/froxlor (critical 9.8)
- [CVE-2023-1306](https://insights.sbomify.com/CVE-2023-1306/): Rapid7 InsightCloudSec resource.db() method access (high 8.8)
- [CVE-2023-1305](https://insights.sbomify.com/CVE-2023-1305/): Rapid7 InsightCloudSec box object access (high 8.1)
- [CVE-2023-1304](https://insights.sbomify.com/CVE-2023-1304/): Rapid7 InsightCloudSec getattr() method access (high 8.8)
- [CVE-2023-1303](https://insights.sbomify.com/CVE-2023-1303/): UCMS System File Management Module fileedit.php unrestricted upload (medium 6.3)
- [CVE-2023-1302](https://insights.sbomify.com/CVE-2023-1302/): SourceCodester File Tracker Manager System borrow1.php cross site scripting (low 3.5)
- [CVE-2023-1301](https://insights.sbomify.com/CVE-2023-1301/): SourceCodester Friendly Island Pizza Website and Ordering System GET Parameter deleteorder.php sql injection (medium 6.3)
- [CVE-2023-1300](https://insights.sbomify.com/CVE-2023-1300/): SourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injection (medium 6.3)
- [CVE-2023-1299](https://insights.sbomify.com/CVE-2023-1299/): Nomad Job Submitter Privilege Escalation Using Workload Identity (high 7.4)
- [CVE-2023-1298](https://insights.sbomify.com/CVE-2023-1298/): Cross-site scripting in Now User Experience (medium 4.3)
- [CVE-2023-1297](https://insights.sbomify.com/CVE-2023-1297/): Consul Cluster Peering can Result in Denial of Service (medium 4.9)
- [CVE-2023-1296](https://insights.sbomify.com/CVE-2023-1296/): Nomad ACLs Can Not Deny Access to Workload's Own Variables (low 2.7)
- [CVE-2023-1295](https://insights.sbomify.com/CVE-2023-1295/): Privilege escalation with IO_RING_OP_CLOSE in the Linux Kernel (high 7.8)
- [CVE-2023-1294](https://insights.sbomify.com/CVE-2023-1294/): SourceCodester File Tracker Manager System POST Parameter login.php sql injection (high 7.3)
- [CVE-2023-1293](https://insights.sbomify.com/CVE-2023-1293/): SourceCodester Online Graduate Tracer System admin_cs.php mysqli_query sql injection (medium 5.0)
- [CVE-2023-1292](https://insights.sbomify.com/CVE-2023-1292/): SourceCodester Sales Tracker Management System Master.php delete_client sql injection (medium 6.3)
- [CVE-2023-1291](https://insights.sbomify.com/CVE-2023-1291/): SourceCodester Sales Tracker Management System manage_client.php sql injection (medium 6.3)
- [CVE-2023-1290](https://insights.sbomify.com/CVE-2023-1290/): SourceCodester Sales Tracker Management System view_client.php sql injection (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/417/