# Vulnerabilities published in 2023


- [CVE-2023-0545](https://insights.sbomify.com/CVE-2023-0545/): Hostel < 1.1.5.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0544](https://insights.sbomify.com/CVE-2023-0544/): WP Login Box <= 2.0.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0543](https://insights.sbomify.com/CVE-2023-0543/): Arigato Autoresponder and Newsletter < 2.1.7.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0542](https://insights.sbomify.com/CVE-2023-0542/): Custom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0541](https://insights.sbomify.com/CVE-2023-0541/): GS Books Showcase < 1.3.1 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2023-0540](https://insights.sbomify.com/CVE-2023-0540/): GS Filterable Portfolio < 1.6.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0539](https://insights.sbomify.com/CVE-2023-0539/): GS Insever Portfolio < 1.4.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0538](https://insights.sbomify.com/CVE-2023-0538/): Campaign URL Builder < 1.8.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0537](https://insights.sbomify.com/CVE-2023-0537/): Product Slider For WooCommerce Lite <= 1.1.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0536](https://insights.sbomify.com/CVE-2023-0536/): Wp-D3 <= 2.4.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0535](https://insights.sbomify.com/CVE-2023-0535/): Donation Block For PayPal < 2.1.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0534](https://insights.sbomify.com/CVE-2023-0534/): SourceCodester Online Tours & Travels Management System expense_report.php sql injection (medium 4.7)
- [CVE-2023-0533](https://insights.sbomify.com/CVE-2023-0533/): SourceCodester Online Tours & Travels Management System expense_report.php sql injection (medium 4.7)
- [CVE-2023-0532](https://insights.sbomify.com/CVE-2023-0532/): SourceCodester Online Tours & Travels Management System disapprove_user.php sql injection (medium 4.7)
- [CVE-2023-0531](https://insights.sbomify.com/CVE-2023-0531/): SourceCodester Online Tours & Travels Management System booking_report.php sql injection (medium 4.7)
- [CVE-2023-0530](https://insights.sbomify.com/CVE-2023-0530/): SourceCodester Online Tours & Travels Management System approve_user.php sql injection (medium 4.7)
- [CVE-2023-0529](https://insights.sbomify.com/CVE-2023-0529/): SourceCodester Online Tours & Travels Management System add_payment.php sql injection (medium 4.7)
- [CVE-2023-0528](https://insights.sbomify.com/CVE-2023-0528/): SourceCodester Online Tours & Travels Management System abc.php sql injection (medium 4.7)
- [CVE-2023-0527](https://insights.sbomify.com/CVE-2023-0527/): PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting (low 3.5)
- [CVE-2023-0526](https://insights.sbomify.com/CVE-2023-0526/): Post Shortcode <= 2.0.9 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-0525](https://insights.sbomify.com/CVE-2023-0525/): Weak cryptography in GOT SIMPLE Series GS21 model (high 7.5)
- [CVE-2023-0524](https://insights.sbomify.com/CVE-2023-0524/): Privilege escalation in Tenable.io, Tenable.sc, Nessus (high 8.8)
- [CVE-2023-0523](https://insights.sbomify.com/CVE-2023-0523/): Cross-site scripting in GitLab (medium 5.4)
- [CVE-2023-0522](https://insights.sbomify.com/CVE-2023-0522/): Enable/Disable Auto Login when Register <= 1.1.0 - Settings Update via CSRF (medium 6.5)
- [CVE-2023-0520](https://insights.sbomify.com/CVE-2023-0520/): RapidExpCart <= 1.0 - Stored XSS via CSRF (medium 5.4)
- [CVE-2023-0519](https://insights.sbomify.com/CVE-2023-0519/): Cross-site Scripting (XSS) - Stored in modoboa/modoboa (high 7.1)
- [CVE-2023-0518](https://insights.sbomify.com/CVE-2023-0518/): Denial of service in GitLab (medium 4.3)
- [CVE-2023-0516](https://insights.sbomify.com/CVE-2023-0516/): SourceCodester Online Tours & Travels Management System Parameter forget_password.php sql injection (medium 5.5)
- [CVE-2023-0515](https://insights.sbomify.com/CVE-2023-0515/): SourceCodester Online Tours & Travels Management System Parameter forget_password.php sql injection (medium 5.5)
- [CVE-2023-0514](https://insights.sbomify.com/CVE-2023-0514/): Membership Database <= 1.0 - Reflected XSS (medium 6.1)
- [CVE-2023-0513](https://insights.sbomify.com/CVE-2023-0513/): isoftforce Dreamer CMS cross site scripting (low 3.5)
- [CVE-2023-0512](https://insights.sbomify.com/CVE-2023-0512/): Divide By Zero in vim/vim (high 7.3)
- [CVE-2023-0511](https://insights.sbomify.com/CVE-2023-0511/): AM Java Policy Agent path traversal (critical 9.1)
- [CVE-2023-0509](https://insights.sbomify.com/CVE-2023-0509/): Improper Certificate Validation in pyload/pyload (high 7.4)
- [CVE-2023-0508](https://insights.sbomify.com/CVE-2023-0508/): Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab (low 3.1)
- [CVE-2023-0507](https://insights.sbomify.com/CVE-2023-0507/): Grafana vulnerable to Cross-site Scripting (high 7.3)
- [CVE-2023-0506](https://insights.sbomify.com/CVE-2023-0506/): ByDemes Group Airspace CCTV Web Service Improper Access Control (high 8.8)
- [CVE-2023-0505](https://insights.sbomify.com/CVE-2023-0505/): Ever Compare <= 1.2.3 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0504](https://insights.sbomify.com/CVE-2023-0504/): HT Politic < 2.3.8 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0503](https://insights.sbomify.com/CVE-2023-0503/): Free WooCommerce Theme 99fy Extension < 1.2.8 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0502](https://insights.sbomify.com/CVE-2023-0502/): WP News <= 1.1.9 - Arbitrary Plugin Activation via CSRF (medium 6.5)
- [CVE-2023-0501](https://insights.sbomify.com/CVE-2023-0501/): WP Insurance < 2.1.4 - Arbitrary Plugin Activation via CSRF (medium 6.5)
- [CVE-2023-0500](https://insights.sbomify.com/CVE-2023-0500/): WP Film Studio < 1.3.5 - Arbitrary Plugin Activation via CSRF (medium 6.5)
- [CVE-2023-0499](https://insights.sbomify.com/CVE-2023-0499/): QuickSwish < 1.1.0 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0498](https://insights.sbomify.com/CVE-2023-0498/): WP Education < 1.2.7 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0497](https://insights.sbomify.com/CVE-2023-0497/): HT Portfolio < 1.1.6 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0496](https://insights.sbomify.com/CVE-2023-0496/): HT Event < 1.4.6 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0495](https://insights.sbomify.com/CVE-2023-0495/): HT Slider For Elementor < 1.4.0 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0494](https://insights.sbomify.com/CVE-2023-0494/): Use after free in xorg-x11-server (high 7.8)
- [CVE-2023-0493](https://insights.sbomify.com/CVE-2023-0493/): Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver (medium 5.3)
- [CVE-2023-0492](https://insights.sbomify.com/CVE-2023-0492/): GS Products Slider for WooCommerce < 1.5.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0491](https://insights.sbomify.com/CVE-2023-0491/): Schedulicity - Easy Online Scheduling <= 2.21 - Contributor+ Stored XSS (medium 6.5)
- [CVE-2023-0490](https://insights.sbomify.com/CVE-2023-0490/): f(x) TOC <= 1.1.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0489](https://insights.sbomify.com/CVE-2023-0489/): SlideOnline <= 1.2.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0488](https://insights.sbomify.com/CVE-2023-0488/): Cross-site Scripting (XSS) - Stored in pyload/pyload (critical 9.6)
- [CVE-2023-0487](https://insights.sbomify.com/CVE-2023-0487/): My Sticky Elements < 2.0.9 - Admin+ SQLi (high 7.2)
- [CVE-2023-0486](https://insights.sbomify.com/CVE-2023-0486/): Cross-site scripting in VitalPBX (medium 6.1)
- [CVE-2023-0485](https://insights.sbomify.com/CVE-2023-0485/): Missing authorization in GitLab (medium 6.5)
- [CVE-2023-0484](https://insights.sbomify.com/CVE-2023-0484/): Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-0483](https://insights.sbomify.com/CVE-2023-0483/): Information disclosure in GitLab (medium 5.5)
- [CVE-2023-0482](https://insights.sbomify.com/CVE-2023-0482/): Insecure Temporary File in RESTEasy (medium 5.5)
- [CVE-2023-0481](https://insights.sbomify.com/CVE-2023-0481/): RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions (low 3.3)
- [CVE-2023-0480](https://insights.sbomify.com/CVE-2023-0480/): Cross-site request forgery in VitalPBX (high 8.8)
- [CVE-2023-0479](https://insights.sbomify.com/CVE-2023-0479/): Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS (medium 6.1)
- [CVE-2023-0477](https://insights.sbomify.com/CVE-2023-0477/): Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload (high 8.8)
- [CVE-2023-0476](https://insights.sbomify.com/CVE-2023-0476/): Other in Tenable.sc (medium 6.5)
- [CVE-2023-0475](https://insights.sbomify.com/CVE-2023-0475/): Go-Getter Vulnerable to Decompression Bombs (medium 4.2)
- [CVE-2023-0474](https://insights.sbomify.com/CVE-2023-0474/): Use after free in Chrome (high 8.8)
- [CVE-2023-0473](https://insights.sbomify.com/CVE-2023-0473/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-0472](https://insights.sbomify.com/CVE-2023-0472/): Use after free in Chrome (high 8.8)
- [CVE-2023-0471](https://insights.sbomify.com/CVE-2023-0471/): Use after free in Chrome (high 8.8)
- [CVE-2023-0470](https://insights.sbomify.com/CVE-2023-0470/): Cross-site Scripting (XSS) - Stored in modoboa/modoboa (high 7.1)
- [CVE-2023-0469](https://insights.sbomify.com/CVE-2023-0469/): Use after free in Kernel (medium 5.5)
- [CVE-2023-0468](https://insights.sbomify.com/CVE-2023-0468/): Use after free in Kernel (medium 4.7)
- [CVE-2023-0467](https://insights.sbomify.com/CVE-2023-0467/): WP Dark Mode < 4.0.8 - Subscriber+ Local File Inclusion (medium 4.3)
- [CVE-2023-0466](https://insights.sbomify.com/CVE-2023-0466/): Certificate policy check not enabled (medium 5.3)
- [CVE-2023-0465](https://insights.sbomify.com/CVE-2023-0465/): Invalid certificate policies in leaf certificates are silently ignored (medium 5.3)
- [CVE-2023-0464](https://insights.sbomify.com/CVE-2023-0464/): Excessive Resource Usage Verifying X.509 Policy Constraints (high 7.5)
- [CVE-2023-0463](https://insights.sbomify.com/CVE-2023-0463/): Security feature bypass in Remote Desktop Manager (high 7.8)
- [CVE-2023-0462](https://insights.sbomify.com/CVE-2023-0462/): Arbitrary code execution through yaml global parameters (high 8.0)
- [CVE-2023-0461](https://insights.sbomify.com/CVE-2023-0461/): Use-after-free vulnerability in the Linux Kernel (high 7.8)
- [CVE-2023-0460](https://insights.sbomify.com/CVE-2023-0460/): Remote code execution in YouTube Android Player API SDK (medium 5.1)
- [CVE-2023-0459](https://insights.sbomify.com/CVE-2023-0459/): Copy_from_user Spectre-V1 Gadget in Linux Kernel (medium 6.5)
- [CVE-2023-0458](https://insights.sbomify.com/CVE-2023-0458/): Spectre V1 Gadget in do_prlimit in the Linux Kernel (medium 5.3)
- [CVE-2023-0457](https://insights.sbomify.com/CVE-2023-0457/): Information Disclosure Vulnerability in MELSEC Series (high 7.5)
- [CVE-2023-0456](https://insights.sbomify.com/CVE-2023-0456/): Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check (high 7.4)
- [CVE-2023-0455](https://insights.sbomify.com/CVE-2023-0455/): Unrestricted Upload of File with Dangerous Type in unilogies/bumsys (high 7.6)
- [CVE-2023-0454](https://insights.sbomify.com/CVE-2023-0454/): Path traversal in OrangeScrum (high 8.1)
- [CVE-2023-0453](https://insights.sbomify.com/CVE-2023-0453/): WP Private Message < 1.0.6 - Private Message Disclosure via IDOR (medium 4.3)
- [CVE-2023-0452](https://insights.sbomify.com/CVE-2023-0452/): Weak cryptography in EOS (critical 9.8)
- [CVE-2023-0451](https://insights.sbomify.com/CVE-2023-0451/): Missing authorization in EOS (high 7.5)
- [CVE-2023-0450](https://insights.sbomify.com/CVE-2023-0450/): Business logic in GitLab (low 3.7)
- [CVE-2023-0448](https://insights.sbomify.com/CVE-2023-0448/): Cross-site scripting in WP Helper Lite Wordpress Plugin (medium 6.1)
- [CVE-2023-0447](https://insights.sbomify.com/CVE-2023-0447/): My YouTube Channel <= 3.0.12.1 - Missing Authorization (medium 4.3)
- [CVE-2023-0446](https://insights.sbomify.com/CVE-2023-0446/): My YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2023-0444](https://insights.sbomify.com/CVE-2023-0444/): Privilege escalation in Delta Electronics InfraSuite Device Master 00.00.02a (high 8.8)
- [CVE-2023-0443](https://insights.sbomify.com/CVE-2023-0443/): AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure (medium 5.3)
- [CVE-2023-0442](https://insights.sbomify.com/CVE-2023-0442/): Loan Comparison < 1.5.2 - Reflected XSS via shortcode (medium 6.1)
- [CVE-2023-0441](https://insights.sbomify.com/CVE-2023-0441/): Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update (high 8.1)
- [CVE-2023-0440](https://insights.sbomify.com/CVE-2023-0440/): Observable Discrepancy in healthchecks/healthchecks (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/425/