Archive
20 June 2023
Vulnerabilities first published on this day (UTC), newest first.
64 results · Feed
-
Medium 6.3CVE-2023-33869 Public exploit
Enphase Envoy OS Command Injection
Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.
-
High 8.6
Enphase Installer Toolkit Android App Use of Hard-coded Credentials
Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.
-
Critical 10.0CVE-2023-35166 EPSS 62%
Privilege escalation (PR) from account through TipsPanel
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 …
-
Low 2.7
Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an admin…
-
Medium 6.3
SourceCodester Online School Fees System GET Parameter ajx.php sql injection
A vulnerability was found in SourceCodester Online School Fees System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajx.php of the component GET Parameter Handler. The manipulation of the argument name_starts…
-
High 8.4
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an a…
KEV Jul 28, 2025 -
Medium 5.9
WordPress Flo Forms Plugin <= 1.0.40 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions.
-
High 7.3
PuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authentication
A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/reg.php of the component Admin Registration. The manipulation lead…
-
Medium 5.3CVE-2023-1999 Public exploit
Use after free in libwebp
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…
-
High 7.1
WordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Internet Marketing Dojo WP Affiliate Links plugin <= 0.1.1 versions.
-
High 7.1
WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions.
-
High 7.3
Remote access to warp-svc.exe in Cloudflare WARP
Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and di…
-
Medium 5.9
WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.
-
Medium 6.5
WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions.
-
High 7.1
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not prope…
-
Medium 5.0
It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT do…
-
Medium 4.3
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. A…
-
Medium 4.3
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. A…
-
Medium 4.3
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. A…
-
Medium 5.0
IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers wi…
-
Low 3.5
Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected …
-
Medium 6.5
Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same co…
-
Low 3.2
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive info…
-
High 7.1
WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.
-
High 8.1
CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated…
-
Medium 6.1CVE-2023-3320 Public exploit
The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,…
-
Critical 9.8
liufee CMS File Upload vulnerability
File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
-
Medium 6.1
Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the ni…
-
Medium 6.1
Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermai…
-
Medium 6.1
Alluxio Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.
-
Critical 9.8
Liufee CMS File Upload vulnerability
File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.
-
High 8.0
Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser functi…
-
High 8.8
Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and …
-
Medium 6.1
Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via t…
-
High 7.5
SQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive information via the _userlist …
-
Critical 9.8
File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plug…
-
Medium 5.4
YiiCMS Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.
-
High 8.8
An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the funct…
-
High 7.2
SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id…
-
High 7.2
An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden pa…