# Vulnerabilities published in 2023


- [CVE-2023-0965](https://insights.sbomify.com/CVE-2023-0965/): Key duplication in GSDK (low 3.1)
- [CVE-2023-0964](https://insights.sbomify.com/CVE-2023-0964/): SourceCodester Sales Tracker Management System view_product.php sql injection (medium 5.0)
- [CVE-2023-0963](https://insights.sbomify.com/CVE-2023-0963/): SourceCodester Music Gallery Site POST Request Users.php access control (high 7.3)
- [CVE-2023-0962](https://insights.sbomify.com/CVE-2023-0962/): SourceCodester Music Gallery Site GET Request Master.php sql injection (medium 6.3)
- [CVE-2023-0961](https://insights.sbomify.com/CVE-2023-0961/): SourceCodester Music Gallery Site GET Request view_music_details.php sql injection (medium 6.3)
- [CVE-2023-0960](https://insights.sbomify.com/CVE-2023-0960/): SeaCMS Picture Management config.ftp.php deserialization (medium 4.7)
- [CVE-2023-0959](https://insights.sbomify.com/CVE-2023-0959/): Cross-site request forgery in Bhima (medium 6.5)
- [CVE-2023-0958](https://insights.sbomify.com/CVE-2023-0958/): Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function (medium 4.3)
- [CVE-2023-0957](https://insights.sbomify.com/CVE-2023-0957/): Cross-site request forgery in Gitpod (high 8.2)
- [CVE-2023-0956](https://insights.sbomify.com/CVE-2023-0956/): TEL-STER TelWin SCADA WebInterface Path Traversal (high 7.5)
- [CVE-2023-0955](https://insights.sbomify.com/CVE-2023-0955/): WP Statistics < 14.0 - Authenticated SQLi (high 8.8)
- [CVE-2023-0954](https://insights.sbomify.com/CVE-2023-0954/): Debug feature in Sensormatic Electronics Illustra Dome and PTZ cameras (high 8.3)
- [CVE-2023-0953](https://insights.sbomify.com/CVE-2023-0953/): SQL injection in Devolutions Server (high 8.8)
- [CVE-2023-0952](https://insights.sbomify.com/CVE-2023-0952/): Missing authorization in Devolutions Server (medium 6.5)
- [CVE-2023-0951](https://insights.sbomify.com/CVE-2023-0951/): Missing authorization in Devolutions Server (high 8.8)
- [CVE-2023-0950](https://insights.sbomify.com/CVE-2023-0950/): Array Index UnderFlow in Calc Formula Parsing (high 7.8)
- [CVE-2023-0949](https://insights.sbomify.com/CVE-2023-0949/): Cross-site Scripting (XSS) - Reflected in modoboa/modoboa (medium 4.8)
- [CVE-2023-0948](https://insights.sbomify.com/CVE-2023-0948/): Japanized For WooCommerce < 2.5.8 - Reflected XSS (medium 6.1)
- [CVE-2023-0947](https://insights.sbomify.com/CVE-2023-0947/): Path Traversal in flatpressblog/flatpress (high 8.1)
- [CVE-2023-0946](https://insights.sbomify.com/CVE-2023-0946/): SourceCodester Best POS Management System sql injection (medium 6.3)
- [CVE-2023-0945](https://insights.sbomify.com/CVE-2023-0945/): SourceCodester Best POS Management System cross site scripting (low 3.5)
- [CVE-2023-0944](https://insights.sbomify.com/CVE-2023-0944/): Missing authorization in Bhima (medium 4.3)
- [CVE-2023-0943](https://insights.sbomify.com/CVE-2023-0943/): SourceCodester Best POS Management System Image save_settings unrestricted upload (medium 4.7)
- [CVE-2023-0942](https://insights.sbomify.com/CVE-2023-0942/): Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-0941](https://insights.sbomify.com/CVE-2023-0941/): Use after free in Chrome (high 8.8)
- [CVE-2023-0940](https://insights.sbomify.com/CVE-2023-0940/): ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password Reset (high 8.8)
- [CVE-2023-0939](https://insights.sbomify.com/CVE-2023-0939/): Multiple SQL Injection on NTN Information Technologies' Online Services software (critical 9.8)
- [CVE-2023-0938](https://insights.sbomify.com/CVE-2023-0938/): SourceCodester Music Gallery Site GET Request music_list.php sql injection (medium 6.3)
- [CVE-2023-0937](https://insights.sbomify.com/CVE-2023-0937/): VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS (medium 6.1)
- [CVE-2023-0936](https://insights.sbomify.com/CVE-2023-0936/): TP-Link Archer C50 Web Management Interface denial of service (medium 6.5)
- [CVE-2023-0935](https://insights.sbomify.com/CVE-2023-0935/): DolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injection (medium 6.3)
- [CVE-2023-0934](https://insights.sbomify.com/CVE-2023-0934/): Cross-site Scripting (XSS) - Stored in answerdev/answer (medium 6.3)
- [CVE-2023-0933](https://insights.sbomify.com/CVE-2023-0933/): Integer overflow in Chrome (high 8.8)
- [CVE-2023-0932](https://insights.sbomify.com/CVE-2023-0932/): Use after free in Chrome (high 8.8)
- [CVE-2023-0931](https://insights.sbomify.com/CVE-2023-0931/): Use after free in Chrome (high 8.8)
- [CVE-2023-0930](https://insights.sbomify.com/CVE-2023-0930/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-0929](https://insights.sbomify.com/CVE-2023-0929/): Use after free in Chrome (high 8.8)
- [CVE-2023-0928](https://insights.sbomify.com/CVE-2023-0928/): Use after free in Chrome (high 8.8)
- [CVE-2023-0927](https://insights.sbomify.com/CVE-2023-0927/): Use after free in Chrome (high 8.8)
- [CVE-2023-0926](https://insights.sbomify.com/CVE-2023-0926/): Custom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-0925](https://insights.sbomify.com/CVE-2023-0925/): Software AG webMethods OneData Deserialization Vulnerability (critical 9.8)
- [CVE-2023-0924](https://insights.sbomify.com/CVE-2023-0924/): Zyrex Popup <= 1.0 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2023-0923](https://insights.sbomify.com/CVE-2023-0923/): Odh-notebook-controller-container: missing authorization allows for file contents disclosure (high 8.8)
- [CVE-2023-0922](https://insights.sbomify.com/CVE-2023-0922/): Information disclosure in Samba (medium 5.9)
- [CVE-2023-0921](https://insights.sbomify.com/CVE-2023-0921/): Allocation of Resources Without Limits or Throttling in GitLab (medium 4.3)
- [CVE-2023-0919](https://insights.sbomify.com/CVE-2023-0919/): Missing Authentication for Critical Function in kareadita/kavita (high 8.1)
- [CVE-2023-0918](https://insights.sbomify.com/CVE-2023-0918/): codeprojects Pharmacy Management System Avatar Image add.php unrestricted upload (medium 6.3)
- [CVE-2023-0917](https://insights.sbomify.com/CVE-2023-0917/): SourceCodester Simple Customer Relationship Management System login.php sql injection (high 7.3)
- [CVE-2023-0916](https://insights.sbomify.com/CVE-2023-0916/): SourceCodester Auto Dealer Management System Users.php access control (medium 6.3)
- [CVE-2023-0915](https://insights.sbomify.com/CVE-2023-0915/): SourceCodester Auto Dealer Management System sql injection (medium 6.3)
- [CVE-2023-0914](https://insights.sbomify.com/CVE-2023-0914/): Improper Authorization in pixelfed/pixelfed (medium 4.3)
- [CVE-2023-0913](https://insights.sbomify.com/CVE-2023-0913/): SourceCodester Auto Dealer Management System sql injection (medium 4.7)
- [CVE-2023-0912](https://insights.sbomify.com/CVE-2023-0912/): SourceCodester Auto Dealer Management System sql injection (medium 4.7)
- [CVE-2023-0911](https://insights.sbomify.com/CVE-2023-0911/): Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure (medium 6.5)
- [CVE-2023-0910](https://insights.sbomify.com/CVE-2023-0910/): SourceCodester Online Pizza Ordering System GET Parameter view_prod.php sql injection (medium 6.3)
- [CVE-2023-0909](https://insights.sbomify.com/CVE-2023-0909/): cxasm notepad-- Directory Comparison denial of service (low 3.3)
- [CVE-2023-0908](https://insights.sbomify.com/CVE-2023-0908/): Xoslab Easy File Locker xlkfs.sys MessageNotifyCallback denial of service (medium 5.5)
- [CVE-2023-0907](https://insights.sbomify.com/CVE-2023-0907/): Filseclab Twister Antivirus IoControlCode ffsmon.sys 0x220017 denial of service (medium 4.4)
- [CVE-2023-0906](https://insights.sbomify.com/CVE-2023-0906/): SourceCodester Online Pizza Ordering System POST Parameter ajax.php delete_category missing authentication (high 7.3)
- [CVE-2023-0905](https://insights.sbomify.com/CVE-2023-0905/): SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication (high 7.3)
- [CVE-2023-0904](https://insights.sbomify.com/CVE-2023-0904/): SourceCodester Employee Task Management System task-details.php sql injection (medium 6.3)
- [CVE-2023-0903](https://insights.sbomify.com/CVE-2023-0903/): SourceCodester Employee Task Management System edit-task.php sql injection (medium 5.0)
- [CVE-2023-0902](https://insights.sbomify.com/CVE-2023-0902/): SourceCodester Simple Food Ordering System process_order.php cross site scripting (low 3.5)
- [CVE-2023-0901](https://insights.sbomify.com/CVE-2023-0901/): Exposure of Sensitive Information to an Unauthorized Actor in pixelfed/pixelfed (medium 5.3)
- [CVE-2023-0900](https://insights.sbomify.com/CVE-2023-0900/): AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi (high 7.2)
- [CVE-2023-0899](https://insights.sbomify.com/CVE-2023-0899/): Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-0898](https://insights.sbomify.com/CVE-2023-0898/): Uncontrolled Search Path Element in GE MiCOM S1 Agile (medium 5.3)
- [CVE-2023-0897](https://insights.sbomify.com/CVE-2023-0897/): Session FIxation in Sielco PolyEco1000 (high 8.8)
- [CVE-2023-0896](https://insights.sbomify.com/CVE-2023-0896/): Hardcoded credentials in Lenovo Smart Clock Essential with Alexa Built In (high 8.8)
- [CVE-2023-0895](https://insights.sbomify.com/CVE-2023-0895/): WP Coder – add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injection (high 7.2)
- [CVE-2023-0894](https://insights.sbomify.com/CVE-2023-0894/): Pickup | Delivery | Dine-in date time <= 1.0.9 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0893](https://insights.sbomify.com/CVE-2023-0893/): Time Sheets < 1.29.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0892](https://insights.sbomify.com/CVE-2023-0892/): BizLibrary <= 1.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0891](https://insights.sbomify.com/CVE-2023-0891/): Stagtools < 2.3.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0890](https://insights.sbomify.com/CVE-2023-0890/): Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post Access (medium 6.5)
- [CVE-2023-0889](https://insights.sbomify.com/CVE-2023-0889/): TF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option Update (medium 6.5)
- [CVE-2023-0888](https://insights.sbomify.com/CVE-2023-0888/): Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi (medium 4.9)
- [CVE-2023-0887](https://insights.sbomify.com/CVE-2023-0887/): phjounin TFTPD64-SE tftpd64_svc.exe unquoted search path (high 7.0)
- [CVE-2023-0883](https://insights.sbomify.com/CVE-2023-0883/): SourceCodester Online Pizza Ordering System index.php sql injection (medium 6.3)
- [CVE-2023-0882](https://insights.sbomify.com/CVE-2023-0882/): Authorization Bypass Through User-Controlled Key on Single Connect (high 8.8)
- [CVE-2023-0881](https://insights.sbomify.com/CVE-2023-0881/): DDoS in Ubuntu package linux-bluefield (high 7.5)
- [CVE-2023-0880](https://insights.sbomify.com/CVE-2023-0880/): Misinterpretation of Input in thorsten/phpmyfaq (high 8.3)
- [CVE-2023-0879](https://insights.sbomify.com/CVE-2023-0879/): Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver (medium 6.3)
- [CVE-2023-0878](https://insights.sbomify.com/CVE-2023-0878/): Cross-site Scripting (XSS) - Generic in nuxt/framework (medium 6.1)
- [CVE-2023-0877](https://insights.sbomify.com/CVE-2023-0877/): Code Injection in froxlor/froxlor (critical 9.1)
- [CVE-2023-0876](https://insights.sbomify.com/CVE-2023-0876/): WP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary Redirect (medium 6.1)
- [CVE-2023-0875](https://insights.sbomify.com/CVE-2023-0875/): WP Meta SEO < 4.5.3 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0874](https://insights.sbomify.com/CVE-2023-0874/): Klaviyo <= 3.0.10 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0873](https://insights.sbomify.com/CVE-2023-0873/): Kanban Boards for WordPress < 2.5.21 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0872](https://insights.sbomify.com/CVE-2023-0872/): ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users (high 8.2)
- [CVE-2023-0871](https://insights.sbomify.com/CVE-2023-0871/): An XML External Entity injection vulnerability (medium 5.4)
- [CVE-2023-0870](https://insights.sbomify.com/CVE-2023-0870/): Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) (high 8.1)
- [CVE-2023-0869](https://insights.sbomify.com/CVE-2023-0869/): Cross-site scripting in outage/list.htm (medium 5.8)
- [CVE-2023-0868](https://insights.sbomify.com/CVE-2023-0868/): Stealing Cookies using Reflected XSS via graph results (medium 6.7)
- [CVE-2023-0867](https://insights.sbomify.com/CVE-2023-0867/): Multiple stored and reflected Cross-site Scripting in webapp (medium 6.7)
- [CVE-2023-0866](https://insights.sbomify.com/CVE-2023-0866/): Heap-based Buffer Overflow in gpac/gpac (high 7.8)
- [CVE-2023-0865](https://insights.sbomify.com/CVE-2023-0865/): WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR (high 8.8)
- [CVE-2023-0864](https://insights.sbomify.com/CVE-2023-0864/): Information disclosure in Terra AC wallbox (CE) (Terra AC MID) (high 7.1)
- [CVE-2023-0863](https://insights.sbomify.com/CVE-2023-0863/): Authentication to access the AC wallbox via its Bluetooth Low Energy (BLE) channel can be bypassed, (high 8.8)
- [CVE-2023-0862](https://insights.sbomify.com/CVE-2023-0862/): Path Traversal in NetModule NSRW (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/421/