Skip to content
OpenAdvisories

Archive

28 December 2023

Vulnerabilities first published on this day (UTC), newest first.

← November 2023 2023 / December /28 January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

26 results · Clear filters · Feed

  • High 7.6
    CVE-2023-50838

    WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.5 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: fro…

    Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more
  • High 8.5
    CVE-2023-50840

    WordPress Booking Manager Plugin <= 2.1.5 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop, oplugins Booking Manager.This issue affects Booking Manager: from n/a through 2.1.5.

    WPdevelop/Oplugins Booking Manager
  • High 8.5
    CVE-2023-50841

    WordPress BookingPress Plugin <= 1.0.72 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Cale…

    Repute InfoSystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin
  • High 8.5
    CVE-2023-50842

    WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar: from n/a through 1.2.1.

    Matthew Fries MF Gig Calendar
  • High 7.6
    CVE-2023-50843

    WordPress Clockwork SMS Notfications Plugin <= 3.0.4 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Clockwork Clockwork SMS Notfications.This issue affects Clockwork SMS Notfications: from n/a through 3.0.4.

    Clockwork Clockwork SMS Notfications
  • High 7.6
    CVE-2023-50844

    WordPress WP Mail Catcher Plugin <= 2.1.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in James Ward Mail logging – WP Mail Catcher.This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3.

    James Ward Mail logging – WP Mail Catcher
  • High 7.6
    CVE-2023-50845

    WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – …

    AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory Web / CMS
  • High 7.6
    CVE-2023-50846

    WordPress RegistrationMagic Plugin <= 5.2.4.5 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login.This issue affects RegistrationMagic – Custom Reg…

    RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
  • High 7.6
    CVE-2023-50847

    WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.

    Collne Welcart e-Commerce
  • High 8.8
    CVE-2023-52082

    Lychee is vulnerable to an SQL Injection in explain DB queries.

    Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The …

    LycheeOrg Lychee
  • High 7.6
    CVE-2023-50848

    WordPress 404 Solution Plugin <= 2.34.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.34.0.

    Aaron J 404 Solution
  • High 7.6
    CVE-2023-50849

    WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.

    E2Pdf.com E2Pdf – Export To Pdf Tool for WordPress Web / CMS
  • High 7.6
    CVE-2023-50852

    WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.

    StylemixThemes Booking Calendar | Appointment Booking | BookIt
  • High 7.6
    CVE-2023-50851

    WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar — Simply Schedule Appoin…

    N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
  • High 7.6
    CVE-2023-50853

    WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms.This issue affects Advanced Form Integrati…

    Nasir Ahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms Web / CMS
  • High 7.6
    CVE-2023-50854

    WordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects Squirrly SEO - Advanced Pack: from n/a before 2.4.02.

    Squirrly Squirrly SEO - Advanced Pack
  • High 7.6
    CVE-2023-50855

    WordPress Pre* Party Resource Hints Plugin <= 1.8.18 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.

    Sam Perrow Pre* Party Resource Hints
  • High 7.6
    CVE-2023-50856

    WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits.This issue affects Funnel…

    FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits Web / CMS
  • High 7.6
    CVE-2023-50857

    WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Ab…

    FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit Web / CMS
  • High 7.5
    CVE-2023-32513

    WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.

    GiveWP GiveWP – Donation Plugin and Fundraising Platform
  • High 8.2
    CVE-2023-32795

    WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.

    woocommerce Product Add-Ons
  • High 7.1
    CVE-2023-51501

    WordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a thro…

    undsgn Uncode - Creative & WooCommerce WordPress Theme Web / CMS
  • High 8.4
    CVE-2023-50448

    Potential CSV export data leak

    In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.

    activeadmin RubyGems
  • High 8.8
    CVE-2023-50692

    File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file upload…

  • High 7.8
    CVE-2023-50445 Public exploit

    Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000…

  • High 7.5
    CVE-2023-52152

    mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain…