Skip to content
OpenAdvisories

Archive

September 2023

Vulnerabilities first published in this month (UTC), newest first.

← August 2023 2023 / September October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

2,174 results · Feed

  • Unscored —
    CVE-2023-40219

    Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to …

    Collne Welcart e-Commerce
  • Critical 9.8
    CVE-2023-3767

    OS command injection on EasyPHP Webserver

    An OS command injection vulnerability has been found on EasyPHP Webserver affecting version 14.1. This vulnerability could allow an attacker to get full access to the system by sending a specially crafted exploit to the /index.php?zone=settings parameter.

    EasyPHP Webserver
  • Medium 5.8
    CVE-2023-41860

    WordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Cross-Site Scripting (XSS) vulnerability in TravelMap plugin <= 1.0.1 versions.

    TravelMap Travel Map
  • High 7.1
    CVE-2023-41861

    WordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Restrict plugin <= 2.2.4 versions.

    restrict Restrict
  • Medium 6.1
    CVE-2023-5192

    Excessive Data Query Operations in a Large Data Table in pimcore/demo

    Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.

    pimcore pimcore/demo pimcore/demo Packagist
  • High 8.1
    CVE-2023-2315

    Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2

    Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server

    OpenCart OpenCart opencart/opencart Packagist
  • Medium 6.4
    CVE-2023-5162

    Options for Twenty Seventeen <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Options for Twenty Seventeen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social-links' shortcode in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thi…

    domainsupport Options for Twenty Seventeen Web / CMS
  • Medium 6.4
    CVE-2023-5135

    Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Simple Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gravity-simple-turnstile' shortcode in versions up to, and including, 1.23.1 due to insufficient input sanitization and output escaping on user supplied att…

    elliotvs Simple CAPTCHA Alternative with Cloudflare Turnstile Web / CMS
  • Medium 6.4
    CVE-2023-5161

    Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authen…

    wpcalc Modal Window – create popup modal window Web / CMS
  • Low 2.2
    CVE-2023-4506

    Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback

    The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated at…

    cyberlord92 Active Directory Integration / LDAP Integration Web / CMS
  • Low 2.2
    CVE-2023-4505

    Staff / Employee Business Directory for Active Directory <= 1.2.3 - Authenticated (Admin+) LDAP Passback

    The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenti…

    cyberlord92 Staff/Employee Business Directory for Active Directory Web / CMS
  • Unscored —
    CVE-2022-48606

    Stability-related vulnerability in the binder background management and control module. Successful exploitation of this…

    Huawei HarmonyOS EMUI Network devices
  • Medium 5.3
    CVE-2023-4565

    Broadcast permission control vulnerability in the framework module. Successful exploitation of this vulnerability may c…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41312

    Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several a…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41311

    Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause an app to…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41310

    Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause mal…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41309

    Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability m…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41308

    Screenshot vulnerability in the input module. Successful exploitation of this vulnerability may affect confidentiality.

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41307

    Memory overwriting vulnerability in the security module. Successful exploitation of this vulnerability may affect avail…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41306

    Vulnerability of mutex management in the bone voice ID trusted application (TA) module. Successful exploitation of this…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-41305

    Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Success…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-35793 Public exploit

    An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vul…

  • Unscored —
    CVE-2023-44042

    A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to exe…

  • Unscored —
    CVE-2023-44170

    SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php.

  • Unscored —
    CVE-2023-44044

    Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /…

  • Unscored —
    CVE-2023-44043

    A reflected cross-site scripting (XSS) vulnerability in /install/index.php of Black Cat CMS 1.4.1 allows attackers to e…

  • Unscored —
    CVE-2023-44216

    PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression tha…

    nvidia-graphics-drivers-304 nvidia-graphics-drivers-340 nvidia-graphics-drivers-440 nvidia-graphics-drivers-455 Ubuntu
  • Unscored —
    CVE-2023-44171

    SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php.

  • Unscored —
    CVE-2023-44169

    SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php.

  • Unscored —
    CVE-2023-44172

    SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.

  • Unscored —
    CVE-2023-41904

    Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.

  • Unscored —
    CVE-2023-43232

    A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows a…

  • Unscored —
    CVE-2023-43154 Public exploit

    In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in "isValidLogin()" function during …

  • Unscored —
    CVE-2023-43263 Public exploit

    A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the …

  • Unscored —
    CVE-2023-43331

    A cross-site scripting (XSS) vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbit…

  • Unscored —
    CVE-2023-43222

    SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.

  • Unscored —
    CVE-2023-43187 Scanner template EPSS 47%

    A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.…

  • Unscored —
    CVE-2023-43234

    DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_co…

  • Unscored —
    CVE-2023-43381

    SQL Injection vulnerability in Tianchoy Blog v.1.8.8 allows a remote attacker to obtain sensitive information via the i…

  • Unscored —
    CVE-2023-43216

    SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.