Skip to content
OpenAdvisories

Archive

21 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /21 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.4
    CVE-2023-46078

    WordPress Serial Numbers for WooCommerce – License Manager Plugin <= 1.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions.

    pluginever WC Serial Numbers
  • Medium 4.3
    CVE-2023-46067

    WordPress Rocket Font Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions.

    Qwerty23 Rocket Font
  • Medium 5.3
    CVE-2023-4939

    SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token

    The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the si…

    salesmanag0 SALESmanago & Leadoo Web / CMS
  • Medium 6.4
    CVE-2023-5205

    Add Custom Body Class <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for au…

    anilankola Add Custom Body Class Web / CMS
  • Medium 6.1
    CVE-2023-4635

    EventON <= 2.2.2 - Reflected Cross-Site Scripting

    The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t…

    Ashan Jay EventON – Events Calendar Web / CMS
  • Medium 4.7
    CVE-2023-5684 EPSS 27%

    Byzoro Smart S85F Management Platform importexport.php os command injection

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The …

    Byzoro Smart S85F Management Platform
  • Medium 6.3
    CVE-2023-5683

    Byzoro Smart S85F Management Platform importconf.php os command injection

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command…

    Byzoro Smart S85F Management Platform
  • Medium 5.4
    CVE-2023-46003 Public exploit

    I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php.