Skip to content
OpenAdvisories

Archive

13 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /13 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

26 results · Clear filters · Feed

  • High 7.1
    CVE-2023-47665

    WordPress Plainview Protect Passwords Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in edward_plainview Plainview Protect Passwords plugin <= 1.4 versions.

    edward_plainview Plainview Protect Passwords
  • High 7.1
    CVE-2023-47673

    WordPress Post Pay Counter Plugin <= 2.784 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Stefano Ottolenghi Post Pay Counter plugin <= 2.784 versions.

    Stefano Ottolenghi Post Pay Counter
  • High 7.1
    CVE-2023-47684 Scanner template

    WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions.

    ThemePunch OHG Essential Grid
  • High 7.1
    CVE-2023-47690

    WordPress Additional Order Filters for WooCommerce Plugin <= 1.10 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Anton Bond Additional Order Filters for WooCommerce plugin <= 1.10 versions.

    Anton Bond Additional Order Filters for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-47695

    WordPress Shortcodes Finder Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Scribit Shortcodes Finder plugin <= 1.5.3 versions.

    Scribit Shortcodes Finder
  • High 7.1
    CVE-2023-47696

    WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions.

    Gravity Master Product Enquiry for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-47697

    WordPress WP Event Manager Plugin <= 3.1.39 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin <= 3.1.39 versions.

    WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Web / CMS
  • High 7.5
    CVE-2023-47117 Scanner template

    Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

    Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensi…

    HumanSignal label-studio label-studio PyPI
  • High 8.8
    CVE-2023-47621

    Remote code execution via file uploads in guest-entries

    Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenti…

    duncanmcclean guest-entries doublethreedigital/guest-entries duncanmcclean/guest-entries Packagist
  • High 7.1
    CVE-2023-31230

    WordPress Baidu Tongji generator Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Haoqisir Baidu Tongji generator allows Stored XSS.This issue affects Baidu Tongji generator: from n/a through 1.0.2.

    Haoqisir Baidu Tongji generator
  • High 7.1
    CVE-2023-35877

    WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from n/a through 0.5.

    Vadym K. Extra User Details
  • High 7.1
    CVE-2023-39166

    WordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4.

    tagDiv tagDiv Composer
  • High 7.3
    CVE-2023-6099

    Shenzhen Youkate Industrial Facial Love Cloud Payment System Account SystemMng.ashx privileges management

    A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the argume…

    Shenzhen Youkate Industrial Facial Love Cloud Payment System
  • High 7.1
    CVE-2023-40335

    WordPress Cleverwise Daily Quotes Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

    Cross-Site Request Forgery (CSRF) vulnerability in Jeremy O'Connell Cleverwise Daily Quotes allows Stored XSS.This issue affects Cleverwise Daily Quotes: from n/a through 3.2.

    Jeremy O'Connell Cleverwise Daily Quotes
  • High 7.1
    CVE-2023-46092

    WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com Webmaster Tools allows Stored XSS.This issue affects Webmaster Tools: from n/a through 2.0.

    LionScripts.com Webmaster Tools
  • High 7.2
    CVE-2023-5747

    Command injection via wave install file

    Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run a…

    Hanwha Vision PNV-A6081R
  • High 7.1
    CVE-2023-5037

    Authenticated Command Injection

    badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera. An attacker could inject malicious into request packets to execute command. The manufacturer has released patch firmware for the flaw, please re…

    Hanwha Vision A-Series, Q-Series, PNM-series Camera
  • High 7.1
    CVE-2023-46201

    WordPress Auto Login New User After Registration Plugin <= 1.9.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration allows Stored XSS.This issue affects Auto Login New User After Registration: from n/a through 1.9.6.

    Jeff Sherk Auto Login New User After Registration
  • High 7.1
    CVE-2023-46634

    WordPress Custom My Account for Woocommerce Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in phoeniixx Custom My Account for Woocommerce allows Cross-Site Scripting (XSS).This issue affects Custom My Account for Woocommerce: from n/a through 2.1.

    phoeniixx Custom My Account for Woocommerce Web / CMS
  • High 7.1
    CVE-2023-47516

    WordPress Category Post List Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

    Cross-Site Request Forgery (CSRF) vulnerability in Stark Digital Category Post List Widget allows Stored XSS.This issue affects Category Post List Widget: from n/a through 2.0.

    Stark Digital Category Post List Widget
  • High 7.1
    CVE-2023-47652

    WordPress Auto Affiliate Links Plugin <= 6.4.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links allows Stored XSS.This issue affects Auto Affiliate Links: from n/a through 6.4.2.4.

    Lucian Apostol Auto Affiliate Links
  • High 7.1
    CVE-2023-23800

    WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate.This issue affects WP Shortcodes Plugin — Shortcodes Ultimate: from n/a through 5.12.6.

    Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate
  • High 7.5
    CVE-2023-47163

    Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack

    Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.

    Remarshal-project Remarshal remarshal PyPI
  • High 8.8
    CVE-2023-35041

    WordPress Webpushr Plugin <= 4.34.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications – Webpushr plugin <= 4.34.0 versions.

    Webpushr Web Push Notifications Web Push Notifications – Webpushr
  • High 8.8
    CVE-2023-48058

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run

  • High 8.8
    CVE-2023-48060

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add