Skip to content
OpenAdvisories

Archive

16 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /16 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

104 results · Feed

  • Unscored —
    CVE-2023-2123 Public exploit

    WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

    The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

    Web / CMS
  • Unscored —
    CVE-2023-0579

    YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi

    The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.

    Web / CMS
  • Unscored —
    CVE-2023-2122 Scanner template

    Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

    The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a l…

    Web / CMS
  • Unscored —
    CVE-2022-4782 Public exploit

    ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode

    The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

    Web / CMS
  • Medium 4.3
    CVE-2023-4381

    Unverified Password Change in instantsoft/icms2

    Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • High 7.5
    CVE-2023-4241

    lol-html panics on certain HTML inputs

    lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.

    Cloudflare lol-html lol-html crates.io
  • High 7.1
    CVE-2023-30871

    WordPress Stock Exporter for WooCommerce Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce plugin <= 1.1.0 versions.

    PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-30779

    WordPress Query Wrangler Plugin <= 1.5.51 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions.

    Jonathan Daggerhart Query Wrangler
  • Medium 6.5
    CVE-2023-30784

    WordPress Kaya QR Code Generator Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions.

    Kaya Studio Kaya QR Code Generator
  • High 7.1
    CVE-2023-30473

    WordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov YML for Yandex Market plugin <= 3.10.7 versions.

    Maxim Glazunov YML for Yandex Market
  • High 7.1
    CVE-2023-30785

    WordPress Video Grid Plugin <= 1.21 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <= 1.21 versions.

    I Thirteen Web Solution Video Grid
  • High 7.1
    CVE-2023-30782

    WordPress Church Admin Plugin <= 3.7.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.5 versions.

    andy_moyle Church Admin
  • Medium 5.9
    CVE-2023-30786

    WordPress Captcha Them All Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Benjamin Guy Captcha Them All plugin <= 1.3.3 versions.

    Benjamin Guy Captcha Them All
  • Unscored —
    CVE-2023-39507

    Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows …

    Recruit "Rikunabi NEXT" App for Android Android
  • Medium 6.1
    CVE-2023-26140

    @excalidraw/excalidraw Cross-site Scripting vulnerability

    Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.

    @excalidraw/excalidraw npm
  • Medium 4.3
    CVE-2023-4374

    WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View

    The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authen…

    frogerme WP Remote Users Sync Web / CMS
  • High 8.5
    CVE-2023-3958

    WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery

    The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above t…

    frogerme WP Remote Users Sync Web / CMS
  • Unscored —
    CVE-2020-26037

    Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows r…

  • Unscored —
    CVE-2023-33663

    In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker ca…

  • High 8.8
    CVE-2023-39975

    kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticate…

  • Unscored —
    CVE-2023-39846

    An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.

  • Unscored —
    CVE-2023-39115 Public exploit

    install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG docu…

  • Critical 9.8
    CVE-2023-38894

    tree-kit Prototype Pollution vulnerability

    A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

    tree-kit npm
  • Unscored —
    CVE-2023-38904

    A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code…