Skip to content
OpenAdvisories

Archive

December 2023

Vulnerabilities first published in this month (UTC), newest first.

← November 2023 2023 / December January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

214 results · Clear filters · Feed

  • Critical 9.3
    CVE-2023-51423

    WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin…

    Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
  • Critical 9.3
    CVE-2023-51469

    WordPress Checkout Mestres WP Plugin <= 7.1.9.6 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.

    Mestres do WP Checkout Mestres WP
  • Critical 9.1
    CVE-2023-49777

    WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.

    Yith YITH WooCommerce Product Add-Ons Web / CMS
  • Critical 10.0
    CVE-2023-52181

    WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1.

    Presslabs Theme per user Web / CMS
  • Critical 9.0
    CVE-2023-39157

    WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.

    Crocoblock JetElements For Elementor
  • Critical 9.9
    CVE-2023-52182

    WordPress ARI Stream Quiz Plugin <= 1.3.0 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes Builder: from n/a through 1.3.0.

    ARI Soft ARI Stream Quiz – WordPress Quizzes Builder Web / CMS
  • Critical 9.8
    CVE-2023-50651

    TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the…

  • Critical 9.8
    CVE-2023-50578 Scanner template

    Mingsoft MCMS SQL injection

    Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2023-41543

    Jeecg Boot SQL Injection

    SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.

    org.jeecgframework.boot:jeecg-boot-common Maven
  • Critical 9.8
    CVE-2023-41542

    Jeecg Boot SQL injection vulnerability

    SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.

    org.jeecgframework.boot:jeecg-boot-common Maven
  • Critical 9.1
    CVE-2023-41544

    JeecgBoot server-side template injection

    SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.

    org.jeecgframework.boot:jeecg-boot-common Maven
  • Critical 9.1
    CVE-2023-52139

    Misskey vulnerable to improper authorization when accessing with third-party application

    Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e4…

    misskey-dev misskey
  • Critical 9.8
    CVE-2023-4675

    SQLi i GM Informatics MDO

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229.  NOTE: The vendor was contacted early about this disclosure b…

    GM Information Technologies MDO
  • Critical 9.8
    CVE-2023-4674

    SQLi in Yazteks E-Commerce Software

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229.  NOTE: …

    Yaztek Software Technologies and Computer Systems E-Commerce Software
  • Critical 9.8
    CVE-2023-4541

    SQLi in Weens Admin Panel

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229.  NOTE: The vendor was contacted early about this disclosure…

    Ween Software Admin Panel
  • Critical 9.9
    CVE-2023-51410

    WordPress WP Mail Log Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.

    WPVibes WP Mail Log
  • Critical 10.0
    CVE-2023-51411

    WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.

    Shabti Kaplan Frontend Admin by DynamiApps
  • Critical 9.0
    CVE-2023-51412

    WordPress Piotnet Forms Plugin <= 1.0.25 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25.

    Piotnet Piotnet Forms
  • Critical 9.9
    CVE-2023-51417

    WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.

    Joris van Montfort JVM Gutenberg Rich Text Icons
  • Critical 10.0
    CVE-2023-51419

    WordPress BERTHA AI Plugin <= 1.11.10.7 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.

    Bertha.ai BERTHA AI. Your AI co-pilot for WordPress and Chrome Web / CMS Browsers
  • Critical 9.9
    CVE-2023-51421

    WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.

    Soft8Soft Verge3D Publishing and E-Commerce
  • Critical 10.0
    CVE-2023-51468

    WordPress Rencontre – Dating Site Plugin <= 3.10.1 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

    Jacques Malgrange Rencontre – Dating Site
  • Critical 10.0
    CVE-2023-51473

    WordPress TerraClassifieds Plugin <= 2.0.3 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.

    Pixelemu TerraClassifieds – Simple Classifieds Plugin
  • Critical 10.0
    CVE-2023-51475

    WordPress WP MLM Unilevel Plugin <= 4.0 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.

    IOSS WP MLM SOFTWARE PLUGIN
  • Critical 9.6
    CVE-2023-51414

    WordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.

    EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters
  • Critical 9.9
    CVE-2023-51422

    WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars,…

    Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
  • Critical 9.9
    CVE-2023-51470

    WordPress Rencontre – Dating Site Plugin <= 3.11.1 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.

    Jacques Malgrange Rencontre – Dating Site
  • Critical 10.0
    CVE-2023-51505

    WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce st…

    RealMag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store Web / CMS
  • Critical 9.6
    CVE-2023-51545

    WordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection

    Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a …

    ThemeHigh Job Manager & Career – Manage job board listings, and recruitments
  • Critical 9.1
    CVE-2023-51420

    WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.

    Soft8Soft Verge3D Publishing and E-Commerce
  • Critical 9.9
    CVE-2023-49830

    WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in Brainstorm Force Astra Pro.This issue affects Astra Pro: from n/a through 4.3.1.

    Brainstorm Force Astra Pro
  • Critical 9.9
    CVE-2023-47840 Public exploit

    WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.

    Qode Interactive Qode Essential Addons
  • Critical 9.9
    CVE-2023-46623

    WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in TienCOP WP EXtra.This issue affects WP EXtra: from n/a through 6.2.

    TienCOP WP EXtra
  • Critical 9.1
    CVE-2023-45751

    WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in POSIMYTH Nexter Extension.This issue affects Nexter Extension: from n/a through 2.0.3.

    POSIMYTH Nexter Extension
  • Critical 9.1
    CVE-2023-40606

    WordPress Kanban Boards for WordPress Plugin <= 2.5.21 is vulnerable to Arbitrary Code Execution

    Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.

    Kanban for WordPress Kanban Boards for WordPress Web / CMS
  • Critical 9.9
    CVE-2023-32095

    WordPress Rename Media Files Plugin <= 1.0.1 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in Milan Dinić Rename Media Files.This issue affects Rename Media Files: from n/a through 1.0.1.

    Milan Dinić Rename Media Files
  • Critical 10.0
    CVE-2023-25054

    WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in David F. Carr RSVPMaker.This issue affects RSVPMaker: from n/a through 10.6.6.

    David F. Carr RSVPMaker
  • Critical 9.3
    CVE-2023-51434

    Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution.

    Honor Magic UI
  • Critical 9.3
    CVE-2023-50839 Public exploit Scanner template

    WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.

    JS Help Desk JS Help Desk – Best Help Desk & Support Plugin
  • Critical 10.0
    CVE-2023-7163

    D-Link D-View 8 Unauthenticated Probe-Core Server Communication

    A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could result in the disclosure of information from other probes, denial of service conditions due to the …

    D-Link D-View 8 Network devices