# Vulnerabilities published in 2023


- [CVE-2023-0332](https://insights.sbomify.com/CVE-2023-0332/): SourceCodester Online Food Ordering System manage_user.php sql injection (high 7.3)
- [CVE-2023-0331](https://insights.sbomify.com/CVE-2023-0331/): Correos Oficial <= 1.2.0.2 - Unauthenticated Arbitrary File Download (high 7.5)
- [CVE-2023-0330](https://insights.sbomify.com/CVE-2023-0330/): Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow (medium 5.3)
- [CVE-2023-0329](https://insights.sbomify.com/CVE-2023-0329/): Elementor Website Builder < 3.12.2 - Admin+ SQLi (high 7.2)
- [CVE-2023-0328](https://insights.sbomify.com/CVE-2023-0328/): WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion (medium 4.3)
- [CVE-2023-0327](https://insights.sbomify.com/CVE-2023-0327/): saemorris TheRadSystem users.php cross site scripting (low 3.5)
- [CVE-2023-0326](https://insights.sbomify.com/CVE-2023-0326/): Information disclosure in GitLab DAST API scanner (medium 5.0)
- [CVE-2023-0325](https://insights.sbomify.com/CVE-2023-0325/): Uvdesk vulnerable to stored cross-site scripting (XSS) (medium 6.1)
- [CVE-2023-0324](https://insights.sbomify.com/CVE-2023-0324/): SourceCodester Online Tours & Travels Management System page-login.php sql injection (high 7.3)
- [CVE-2023-0323](https://insights.sbomify.com/CVE-2023-0323/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.1)
- [CVE-2023-0322](https://insights.sbomify.com/CVE-2023-0322/): XSS in Talent Software UNIS (medium 6.1)
- [CVE-2023-0321](https://insights.sbomify.com/CVE-2023-0321/): Disclosure of Sensitive Information on Campbell Scientific Products (critical 9.1)
- [CVE-2023-0320](https://insights.sbomify.com/CVE-2023-0320/): XSS in UBYS (medium 5.4)
- [CVE-2023-0319](https://insights.sbomify.com/CVE-2023-0319/): Missing authorization in GitLab (medium 5.8)
- [CVE-2023-0317](https://insights.sbomify.com/CVE-2023-0317/): GateManager debug interface is included in non-debug builds (medium 4.9)
- [CVE-2023-0316](https://insights.sbomify.com/CVE-2023-0316/): Path Traversal: '\..\filename' in froxlor/froxlor (medium 6.8)
- [CVE-2023-0315](https://insights.sbomify.com/CVE-2023-0315/): Command Injection in froxlor/froxlor (high 7.2)
- [CVE-2023-0314](https://insights.sbomify.com/CVE-2023-0314/): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (medium 6.5)
- [CVE-2023-0313](https://insights.sbomify.com/CVE-2023-0313/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 4.7)
- [CVE-2023-0312](https://insights.sbomify.com/CVE-2023-0312/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.6)
- [CVE-2023-0311](https://insights.sbomify.com/CVE-2023-0311/): Improper Authentication in thorsten/phpmyfaq (medium 5.3)
- [CVE-2023-0310](https://insights.sbomify.com/CVE-2023-0310/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (critical 9.8)
- [CVE-2023-0309](https://insights.sbomify.com/CVE-2023-0309/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.6)
- [CVE-2023-0308](https://insights.sbomify.com/CVE-2023-0308/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 7.6)
- [CVE-2023-0307](https://insights.sbomify.com/CVE-2023-0307/): Weak Password Requirements in thorsten/phpmyfaq (medium 5.7)
- [CVE-2023-0306](https://insights.sbomify.com/CVE-2023-0306/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (critical 9.1)
- [CVE-2023-0305](https://insights.sbomify.com/CVE-2023-0305/): SourceCodester Online Food Ordering System Login Module admin_class.php sql injection (medium 6.3)
- [CVE-2023-0304](https://insights.sbomify.com/CVE-2023-0304/): SourceCodester Online Food Ordering System Signup Module admin_class.php sql injection (medium 6.3)
- [CVE-2023-0303](https://insights.sbomify.com/CVE-2023-0303/): SourceCodester Online Food Ordering System view_prod.php sql injection (medium 6.3)
- [CVE-2023-0302](https://insights.sbomify.com/CVE-2023-0302/): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2 (high 8.6)
- [CVE-2023-0301](https://insights.sbomify.com/CVE-2023-0301/): Cross-site Scripting (XSS) - Stored in alfio-event/alf.io (medium 4.3)
- [CVE-2023-0300](https://insights.sbomify.com/CVE-2023-0300/): Cross-site Scripting (XSS) - Reflected in alfio-event/alf.io (low 3.5)
- [CVE-2023-0299](https://insights.sbomify.com/CVE-2023-0299/): Improper Input Validation in publify/publify (high 8.4)
- [CVE-2023-0298](https://insights.sbomify.com/CVE-2023-0298/): Incorrect Authorization in firefly-iii/firefly-iii (medium 6.5)
- [CVE-2023-0297](https://insights.sbomify.com/CVE-2023-0297/): Code Injection in pyload/pyload (critical 9.8)
- [CVE-2023-0296](https://insights.sbomify.com/CVE-2023-0296/): Weak cryptography in Red Hat OpenShift (medium 5.3)
- [CVE-2023-0295](https://insights.sbomify.com/CVE-2023-0295/): Launchpad – Coming Soon & Maintenance Mode Plugin <= 1.0.13 - Authenticated (Administrator+) Cross-Site Scripting (medium 5.5)
- [CVE-2023-0294](https://insights.sbomify.com/CVE-2023-0294/): Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery (high 8.8)
- [CVE-2023-0293](https://insights.sbomify.com/CVE-2023-0293/): Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorization (medium 4.3)
- [CVE-2023-0292](https://insights.sbomify.com/CVE-2023-0292/): Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion (medium 5.4)
- [CVE-2023-0291](https://insights.sbomify.com/CVE-2023-0291/): Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion (high 7.2)
- [CVE-2023-0290](https://insights.sbomify.com/CVE-2023-0290/): Rapid7 Velociraptor directory traversal in client ID parameter (medium 4.3)
- [CVE-2023-0289](https://insights.sbomify.com/CVE-2023-0289/): Cross-site Scripting (XSS) - Stored in craigk5n/webcalendar (high 7.6)
- [CVE-2023-0288](https://insights.sbomify.com/CVE-2023-0288/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2023-0287](https://insights.sbomify.com/CVE-2023-0287/): ityouknow favorites-web Comment cross site scripting (low 3.5)
- [CVE-2023-0286](https://insights.sbomify.com/CVE-2023-0286/): X.400 address type confusion in X.509 GeneralName (high 7.4)
- [CVE-2023-0285](https://insights.sbomify.com/CVE-2023-0285/): Real Media Library < 4.18.29 - Author+ Stored XSS (medium 5.4)
- [CVE-2023-0284](https://insights.sbomify.com/CVE-2023-0284/): Improper validation of LDAP user IDs (medium 6.8)
- [CVE-2023-0283](https://insights.sbomify.com/CVE-2023-0283/): SourceCodester Online Flight Booking Management System POST Parameter review_search.php sql injection (medium 6.3)
- [CVE-2023-0282](https://insights.sbomify.com/CVE-2023-0282/): YourChannel < 1.2.2 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-0281](https://insights.sbomify.com/CVE-2023-0281/): SourceCodester Online Flight Booking Management System judge_panel.php sql injection (medium 6.3)
- [CVE-2023-0280](https://insights.sbomify.com/CVE-2023-0280/): Ultimate Carousel For Elementor <= 2.1.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0279](https://insights.sbomify.com/CVE-2023-0279/): Media Library Assistant < 3.06 - Admin+ SQLi (high 7.2)
- [CVE-2023-0278](https://insights.sbomify.com/CVE-2023-0278/): GeoDirectory < 2.2.24 - Admin+ SQLi (high 7.2)
- [CVE-2023-0277](https://insights.sbomify.com/CVE-2023-0277/): WC Fields Factory <= 4.1.5 - ShopManager+ SQLi (high 7.2)
- [CVE-2023-0276](https://insights.sbomify.com/CVE-2023-0276/): Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0275](https://insights.sbomify.com/CVE-2023-0275/): Easy Accept Payments for PayPal < 4.9.10 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0274](https://insights.sbomify.com/CVE-2023-0274/): URL Params < 2.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0273](https://insights.sbomify.com/CVE-2023-0273/): Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0272](https://insights.sbomify.com/CVE-2023-0272/): NEX-Forms < 8.3.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0271](https://insights.sbomify.com/CVE-2023-0271/): WP Font Awesome < 1.7.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0270](https://insights.sbomify.com/CVE-2023-0270/): YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0268](https://insights.sbomify.com/CVE-2023-0268/): Mega Addons For WPBakery Page Builder < 4.3.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0267](https://insights.sbomify.com/CVE-2023-0267/): Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0266](https://insights.sbomify.com/CVE-2023-0266/): Linux Kernel Use-After-Free (high 7.9, exploited in the wild)
- [CVE-2023-0265](https://insights.sbomify.com/CVE-2023-0265/): Uvdesk remote code execution vulnerability (high 8.8)
- [CVE-2023-0264](https://insights.sbomify.com/CVE-2023-0264/): Keycloak vulnerable to user impersonation via stolen UUID code (medium 5.0)
- [CVE-2023-0263](https://insights.sbomify.com/CVE-2023-0263/): WP Yelp Review Slider < 7.1 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0262](https://insights.sbomify.com/CVE-2023-0262/): WP Airbnb Review Slider < 3.3 - Subscriber+ SQLi (high 7.7)
- [CVE-2023-0261](https://insights.sbomify.com/CVE-2023-0261/): WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0260](https://insights.sbomify.com/CVE-2023-0260/): WP Review Slider < 12.2 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0259](https://insights.sbomify.com/CVE-2023-0259/): WP Google Review Slider < 11.8 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0258](https://insights.sbomify.com/CVE-2023-0258/): SourceCodester Online Food Ordering System Category List cross site scripting (low 2.4)
- [CVE-2023-0257](https://insights.sbomify.com/CVE-2023-0257/): SourceCodester Online Food Ordering System Menu Form unrestricted upload (medium 4.7)
- [CVE-2023-0256](https://insights.sbomify.com/CVE-2023-0256/): SourceCodester Online Food Ordering System Login Page sql injection (medium 6.3)
- [CVE-2023-0255](https://insights.sbomify.com/CVE-2023-0255/): Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload (high 8.8)
- [CVE-2023-0254](https://insights.sbomify.com/CVE-2023-0254/): Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection (high 7.2)
- [CVE-2023-0252](https://insights.sbomify.com/CVE-2023-0252/): Contextual Related Posts < 3.3.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0251](https://insights.sbomify.com/CVE-2023-0251/): CVE-2023-0251 (high 7.8)
- [CVE-2023-0250](https://insights.sbomify.com/CVE-2023-0250/): CVE-2023-0250 (high 7.8)
- [CVE-2023-0249](https://insights.sbomify.com/CVE-2023-0249/): CVE-2023-0249 (high 7.8)
- [CVE-2023-0248](https://insights.sbomify.com/CVE-2023-0248/): Kantech Gen1 ioSmart card reader (high 7.5)
- [CVE-2023-0247](https://insights.sbomify.com/CVE-2023-0247/): Uncontrolled Search Path Element in bits-and-blooms/bloom (high 7.8)
- [CVE-2023-0246](https://insights.sbomify.com/CVE-2023-0246/): earclink ESPCMS Content cross site scripting (low 3.5)
- [CVE-2023-0245](https://insights.sbomify.com/CVE-2023-0245/): SourceCodester Online Flight Booking Management System add_contestant.php sql injection (medium 6.3)
- [CVE-2023-0244](https://insights.sbomify.com/CVE-2023-0244/): TuziCMS KefuController.class.php delall sql injection (medium 6.3)
- [CVE-2023-0243](https://insights.sbomify.com/CVE-2023-0243/): TuziCMS Article Module ArticleController.class.php index sql injection (medium 6.3)
- [CVE-2023-0242](https://insights.sbomify.com/CVE-2023-0242/): Insufficient permission check in the VQL copy() function (high 8.8)
- [CVE-2023-0241](https://insights.sbomify.com/CVE-2023-0241/): pgAdmin 4 vulnerable to directory traversal (medium 6.5)
- [CVE-2023-0240](https://insights.sbomify.com/CVE-2023-0240/): Use after free in io_uring in the Linux Kernel (high 7.8)
- [CVE-2023-0238](https://insights.sbomify.com/CVE-2023-0238/): Injecting Activity Loads in WARP Mobile Client (low 3.9)
- [CVE-2023-0236](https://insights.sbomify.com/CVE-2023-0236/): Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-0234](https://insights.sbomify.com/CVE-2023-0234/): SiteGround Security < 1.3.1 - Admin+ SQLi (high 8.8)
- [CVE-2023-0233](https://insights.sbomify.com/CVE-2023-0233/): ActiveCampaign < 8.1.12 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0232](https://insights.sbomify.com/CVE-2023-0232/): ShopLentor < 2.5.4 - PHP Object Injection (critical 9.8)
- [CVE-2023-0231](https://insights.sbomify.com/CVE-2023-0231/): ShopLentor < 2.5.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0230](https://insights.sbomify.com/CVE-2023-0230/): VK All in One Expansion Unit < 9.86.0.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0229](https://insights.sbomify.com/CVE-2023-0229/): github.com/openshift/apiserver-library-go Improper Input Validation vulnerability (medium 6.3)
- [CVE-2023-0228](https://insights.sbomify.com/CVE-2023-0228/): Improper authentication vulnerability in S+ Operations (high 8.8)
- [CVE-2023-0227](https://insights.sbomify.com/CVE-2023-0227/): Insufficient Session Expiration in pyload/pyload (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/427/