Skip to content
OpenAdvisories

Archive

21 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /21 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • Medium 5.4
    CVE-2023-46078

    WordPress Serial Numbers for WooCommerce – License Manager Plugin <= 1.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions.

    pluginever WC Serial Numbers
  • Medium 4.3
    CVE-2023-46067

    WordPress Rocket Font Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions.

    Qwerty23 Rocket Font
  • Medium 5.3
    CVE-2023-4939

    SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token

    The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the si…

    salesmanag0 SALESmanago & Leadoo Web / CMS
  • Medium 6.4
    CVE-2023-5205

    Add Custom Body Class <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for au…

    anilankola Add Custom Body Class Web / CMS
  • Medium 6.1
    CVE-2023-4635

    EventON <= 2.2.2 - Reflected Cross-Site Scripting

    The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t…

    Ashan Jay EventON – Events Calendar Web / CMS
  • Medium 4.7
    CVE-2023-5684 EPSS 27%

    Byzoro Smart S85F Management Platform importexport.php os command injection

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The …

    Byzoro Smart S85F Management Platform
  • Medium 6.3
    CVE-2023-5683

    Byzoro Smart S85F Management Platform importconf.php os command injection

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command…

    Byzoro Smart S85F Management Platform
  • High 7.5
    CVE-2023-5132

    Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure

    The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers wi…

    soisytech Soisy Pagamento Rateale Web / CMS
  • Unscored —
    CVE-2023-38190

    An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.

  • Unscored —
    CVE-2023-38193

    An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command …

  • Unscored —
    CVE-2023-38192 Scanner template

    An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwo…

  • Unscored —
    CVE-2023-38194 Scanner template

    An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.

  • Unscored —
    CVE-2023-46055

    An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a cr…

  • Medium 5.4
    CVE-2023-46003 Public exploit

    I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php.

  • Unscored —
    CVE-2023-46054

    Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges…