Skip to content
OpenAdvisories

Archive

28 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /28 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

34 results · Feed

  • Medium 5.5
    CVE-2021-4336

    ITRS Group monitor-ninja scheduled_reports.php sql injection

    A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgra…

    ITRS Group monitor-ninja
  • Medium 4.3
    CVE-2022-36345

    WordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions.

    Metagauss Download Plugin
  • High 7.1
    CVE-2023-33926

    WordPress Easy Google Maps Plugin <= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions.

    supsystic Easy Google Maps
  • High 7.1
    CVE-2023-33332

    WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.

    woocommerce WooCommerce Product Vendors Web / CMS
  • Medium 6.5
    CVE-2023-28785

    WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.

    Yoast Yoast SEO: Local
  • High 7.1
    CVE-2023-32800

    WordPress Rank Math SEO PRO Plugin <= 3.0.35 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions.

    One Rank Math SEO PRO
  • Medium 6.5
    CVE-2023-33311

    WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions.

    CRM Perks Contact Form Entries
  • Medium 4.3
    CVE-2023-33313

    WordPress WIP Custom Login Plugin <= 1.2.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.

    ThemeinProgress WIP Custom Login
  • Medium 5.9
    CVE-2023-33211

    WordPress WP-Piwik Plugin <= 1.0.27 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.

    André Bräkling WP-Matomo Integration (WP-Piwik)
  • High 7.1
    CVE-2023-33319

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

    woocommerce WooCommerce Follow-Up Emails (AutomateWoo) Web / CMS
  • Medium 5.4
    CVE-2023-33316

    WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

    woocommerce WooCommerce Follow-Up Emails (AutomateWoo) Web / CMS
  • Medium 5.9
    CVE-2023-33328

    WordPress MailChimp Subscribe Forms Plugin <= 4.0.9.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps MailChimp Subscribe Form plugin <= 4.0.9.1 versions.

    PluginOps MailChimp Subscribe Form
  • High 7.1
    CVE-2023-33326

    WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.

    EventPrime EventPrime
  • High 7.1
    CVE-2023-33309

    WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.

    Awesome Motive Duplicator Pro
  • Medium 5.4
    CVE-2023-33314

    WordPress BEAR Plugin <= 1.1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.

    RealMag777 BEAR
  • Medium 4.3
    CVE-2023-33212

    WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions.

    Crocoblock JetFormBuilder — Dynamic Blocks Form Builder
  • Medium 4.3
    CVE-2023-33931

    WordPress YouTube Playlist Player Plugin <= 4.6.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.4 versions.

    Ciprian Popescu YouTube Playlist Player
  • Medium 5.4
    CVE-2023-33315

    WordPress Smart App Banner Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.2 versions.

    Stephen Darlington, Wandle Software Smart App Banner
  • Medium 5.9
    CVE-2023-32958

    WordPress Novelist Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nose Graze Novelist plugin <= 1.2.0 versions.

    Nose Graze Novelist
  • Medium 5.9
    CVE-2023-33216

    WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.

    gVectors Team WooDiscuz – WooCommerce Comments Web / CMS
  • Medium 6.3
    CVE-2015-10106

    mback2k mh_httpbl Extension index.php moduleContent sql injection

    ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This vulnerability affects the function moduleContent of the file mod1/index.php. The manipulation leads to sql injection. Th…

    mback2k mh_httpbl Extension
  • Medium 6.3
    CVE-2014-125101

    Portfolio Gallery Plugin sql injection

    A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is ab…

  • Medium 6.3
    CVE-2023-2951

    code-projects Bus Dispatch and Information System delete_bus.php sql injection

    A vulnerability classified as critical has been found in code-projects Bus Dispatch and Information System 1.0. Affected is an unknown function of the file delete_bus.php. The manipulation of the argument busid leads to sql injection. It is possible to launch…

    code-projects Bus Dispatch and Information System
  • High 7.4
    CVE-2023-33291

    In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP …

  • Unscored —
    CVE-2023-32763

    An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file w…

    qtbase-opensource-src qtbase-opensource-src qt6-base qt6-base Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2023-32762

    An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorr…

    qtbase-opensource-src qtbase-opensource-src qt6-base qt6-base Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-29380

    Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.

  • High 7.8
    CVE-2023-31873 Public exploit

    Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').

  • High 8.8
    CVE-2023-31874 Public exploit

    Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_pr…

  • High 8.3
    CVE-2023-2948 Scanner template EPSS 97%

    Cross-site Scripting (XSS) - Generic in openemr/openemr

    Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.

    Open-Emr openemr/openemr
  • Medium 6.3
    CVE-2023-2950

    Improper Authorization in openemr/openemr

    Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.

    Open-Emr openemr/openemr
  • High 8.3
    CVE-2023-2949 Scanner template

    Cross-site Scripting (XSS) - Reflected in openemr/openemr

    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.

    Open-Emr openemr/openemr
  • High 7.5
    CVE-2023-30570

    pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthentica…

    libreswan libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2023-30350 Public exploit

    FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin…