Skip to content
OpenAdvisories

Archive

20 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /20 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 4.3
    CVE-2022-47134

    WordPress Gallery Metabox Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.

    Bill Erickson Gallery Metabox
  • Medium 4.3
    CVE-2023-32589

    WordPress Dyslexiefont Free Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PingOnline Dyslexiefont Free plugin <= 1.0.0 versions.

    PingOnline Dyslexiefont Free
  • Medium 5.4
    CVE-2023-22689

    WordPress Auto Affiliate Links Plugin <= 6.3 is vulnerable to Broken Access Control

    Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.

    Lucian Apostol Auto Affiliate Links
  • Medium 4.3
    CVE-2023-24414

    WordPress Robo Gallery Plugin <= 3.2.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.

    Robosoft Photo Gallery, Images, Slider in Rbs Image Gallery
  • Medium 6.3
    CVE-2023-2823

    SourceCodester Class Scheduling System GET Parameter edit_subject.php sql injection

    A vulnerability was found in SourceCodester Class Scheduling System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit_subject.php of the component GET Parameter Handler. The manipulation …

    SourceCodester Class Scheduling System
  • Medium 4.3
    CVE-2023-2822 Public exploit Scanner template

    Ellucian Ethos Identity logout cross site scripting

    A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the…

    Ellucian Ethos Identity
  • Medium 5.4
    CVE-2023-2717

    Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins

    The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enable_safe_mode' function. This makes it possible for unauthenticated attackers to enab…

    trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation Web / CMS
  • Medium 4.9
    CVE-2023-2735

    Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib…

    trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation Web / CMS
  • Medium 5.4
    CVE-2023-2716

    Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload

    The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated …

    trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation Web / CMS
  • Medium 4.3
    CVE-2023-2714

    Groundhogg <= 2.7.9.8 - Missing Authorization to Update License

    The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subsc…

    trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation Web / CMS
  • Medium 4.3
    CVE-2023-2715

    Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

    The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a …

    trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation Web / CMS