Skip to content
OpenAdvisories

Archive

16 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /16 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Low 2.6
    CVE-2023-5013

    Pluck CMS Installation install.php cross site scripting

    A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xs…

    Pluck CMS
  • Medium 5.3
    CVE-2023-5012

    Topaz OFD Protection Module Warsaw core.exe unquoted search path

    A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Warsaw\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search p…

    Topaz OFD
  • High 7.2
    CVE-2023-3025

    Dropbox Folder Share <= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link'

    The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from …

    hyno Dropbox Folder Share Web / CMS
  • Medium 6.4
    CVE-2023-5001

    Horizontal scrolling announcement <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Horizontal scrolling announcement plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping on user supplied attr…

    Gopiplus Horizontal scrolling announcement Web / CMS
  • Critical 9.9
    CVE-2023-4994

    Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode

    The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on th…

    hit-reach Allow PHP in Posts and Pages Web / CMS
  • Unscored —
    CVE-2023-39777

    A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to …

  • Unscored —
    CVE-2023-39612

    A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate p…

  • Unscored —
    CVE-2023-41157

    Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary …

  • Unscored —
    CVE-2023-42336

    An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive…