Skip to content
OpenAdvisories

Archive

December 2023

Vulnerabilities first published in this month (UTC), newest first.

← November 2023 2023 / December January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

625 results · Clear filters · Feed

  • High 8.5
    CVE-2023-50840

    WordPress Booking Manager Plugin <= 2.1.5 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop, oplugins Booking Manager.This issue affects Booking Manager: from n/a through 2.1.5.

    WPdevelop/Oplugins Booking Manager
  • High 8.5
    CVE-2023-50841

    WordPress BookingPress Plugin <= 1.0.72 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Cale…

    Repute InfoSystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin
  • High 8.5
    CVE-2023-50842

    WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar: from n/a through 1.2.1.

    Matthew Fries MF Gig Calendar
  • High 7.6
    CVE-2023-50843

    WordPress Clockwork SMS Notfications Plugin <= 3.0.4 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Clockwork Clockwork SMS Notfications.This issue affects Clockwork SMS Notfications: from n/a through 3.0.4.

    Clockwork Clockwork SMS Notfications
  • High 7.6
    CVE-2023-50844

    WordPress WP Mail Catcher Plugin <= 2.1.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in James Ward Mail logging – WP Mail Catcher.This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3.

    James Ward Mail logging – WP Mail Catcher
  • High 7.6
    CVE-2023-50845

    WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – …

    AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory Web / CMS
  • High 7.6
    CVE-2023-50846

    WordPress RegistrationMagic Plugin <= 5.2.4.5 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login.This issue affects RegistrationMagic – Custom Reg…

    RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
  • High 7.6
    CVE-2023-50847

    WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.

    Collne Welcart e-Commerce
  • High 8.8
    CVE-2023-52082

    Lychee is vulnerable to an SQL Injection in explain DB queries.

    Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The …

    LycheeOrg Lychee
  • High 7.6
    CVE-2023-50848

    WordPress 404 Solution Plugin <= 2.34.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.34.0.

    Aaron J 404 Solution
  • High 7.6
    CVE-2023-50849

    WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.

    E2Pdf.com E2Pdf – Export To Pdf Tool for WordPress Web / CMS
  • High 7.6
    CVE-2023-50852

    WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.

    StylemixThemes Booking Calendar | Appointment Booking | BookIt
  • High 7.6
    CVE-2023-50851

    WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar — Simply Schedule Appoin…

    N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
  • High 7.6
    CVE-2023-50853

    WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms.This issue affects Advanced Form Integrati…

    Nasir Ahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms Web / CMS
  • High 7.6
    CVE-2023-50854

    WordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects Squirrly SEO - Advanced Pack: from n/a before 2.4.02.

    Squirrly Squirrly SEO - Advanced Pack
  • High 7.6
    CVE-2023-50855

    WordPress Pre* Party Resource Hints Plugin <= 1.8.18 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.

    Sam Perrow Pre* Party Resource Hints
  • High 7.6
    CVE-2023-50856

    WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits.This issue affects Funnel…

    FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits Web / CMS
  • High 7.6
    CVE-2023-50857

    WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Ab…

    FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit Web / CMS
  • High 7.5
    CVE-2023-32513

    WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.

    GiveWP GiveWP – Donation Plugin and Fundraising Platform
  • High 8.2
    CVE-2023-32795

    WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.

    woocommerce Product Add-Ons
  • High 7.1
    CVE-2023-51501

    WordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a thro…

    undsgn Uncode - Creative & WooCommerce WordPress Theme Web / CMS
  • High 8.4
    CVE-2023-50448

    Potential CSV export data leak

    In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.

    activeadmin RubyGems
  • High 8.8
    CVE-2023-50692

    File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file upload…

  • High 7.8
    CVE-2023-50445 Public exploit

    Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000…

  • High 7.5
    CVE-2023-52152

    mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain…

  • High 7.5
    CVE-2023-52075

    ReVanced API vulnerable to Denial of Service due to lack of error caching

    ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This…

    ReVanced revanced-api
  • High 8.9
    CVE-2023-52077

    External apps using tokens issued by administrators and moderators can call admin APIs

    Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform …

    nexryai nexkey
  • High 7.3
    CVE-2023-51664

    tj-actions/changed-files command injection in output filenames

    tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak …

    tj-actions changed-files tj-actions/changed-files GitHub Actions
  • High 7.5
    CVE-2023-51443

    FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITC…

    signalwire freeswitch freeswitch Alpine
  • High 7.5
    CVE-2023-3171

    Eap-7: heap exhaustion via deserialization

    A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could ev…

    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
  • High 7.5
    CVE-2023-51080

    hutool-core was discovered to contain a stack overflow via NumberUtil.toBigDecimal method

    The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.

    cn.hutool:hutool-core Maven
  • High 7.5
    CVE-2023-51075

    hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function

    hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters.

    cn.hutool:hutool-core Maven
  • High 7.6
    CVE-2023-5644

    WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

    The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

    Web / CMS
  • High 7.5
    CVE-2023-5203 Scanner template

    WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection

    The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time…

    Web / CMS
  • High 7.8
    CVE-2023-5180 Public exploit

    Out-of-bounds Write vulnerability exists in ODA Drawings SDK before 2024.12

    An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in…

    Open Design Alliance ODA Drawings SDK - All Versions < 2024.12
  • High 7.3
    CVE-2023-7110

    code-projects Library Management System login.php sql injection

    A vulnerability, which was classified as critical, has been found in code-projects Library Management System 2.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument student leads to sql injection. The attack may…

    code-projects Library Management System
  • High 7.3
    CVE-2023-7109

    code-projects Library Management System login.php sql injection

    A vulnerability classified as critical was found in code-projects Library Management System 2.0. This vulnerability affects unknown code of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack can be initiate…

    code-projects Library Management System
  • High 8.8
    CVE-2023-51092 EPSS 13%

    Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.

  • High 7.5
    CVE-2023-51107

    A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_col…

    mupdf mupdf Debian Ubuntu
  • High 7.5
    CVE-2023-51104

    A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary…

    mupdf mupdf Debian Ubuntu