Skip to content
OpenAdvisories

Archive

December 2023

Vulnerabilities first published in this month (UTC), newest first.

← November 2023 2023 / December January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

2,697 results · Feed

  • Critical 9.8
    CVE-2023-4674

    SQLi in Yazteks E-Commerce Software

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229.  NOTE: …

    Yaztek Software Technologies and Computer Systems E-Commerce Software
  • Critical 9.8
    CVE-2023-4541

    SQLi in Weens Admin Panel

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229.  NOTE: The vendor was contacted early about this disclosure…

    Ween Software Admin Panel
  • Unscored —
    CVE-2023-47804

    Apache OpenOffice: Macro URL arbitrary script execution

    Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject …

    Apache Software Foundation Apache OpenOffice
  • Medium 4.7
    CVE-2023-51675

    WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security …

    AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
  • Critical 9.9
    CVE-2023-51410

    WordPress WP Mail Log Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.

    WPVibes WP Mail Log
  • Critical 10.0
    CVE-2023-51411

    WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.

    Shabti Kaplan Frontend Admin by DynamiApps
  • Critical 9.0
    CVE-2023-51412

    WordPress Piotnet Forms Plugin <= 1.0.25 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25.

    Piotnet Piotnet Forms
  • Critical 9.9
    CVE-2023-51417

    WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.

    Joris van Montfort JVM Gutenberg Rich Text Icons
  • Critical 10.0
    CVE-2023-51419

    WordPress BERTHA AI Plugin <= 1.11.10.7 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.

    Bertha.ai BERTHA AI. Your AI co-pilot for WordPress and Chrome Web / CMS Browsers
  • Critical 9.9
    CVE-2023-51421

    WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.

    Soft8Soft Verge3D Publishing and E-Commerce
  • Critical 10.0
    CVE-2023-51468

    WordPress Rencontre – Dating Site Plugin <= 3.10.1 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

    Jacques Malgrange Rencontre – Dating Site
  • Critical 10.0
    CVE-2023-51473

    WordPress TerraClassifieds Plugin <= 2.0.3 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.

    Pixelemu TerraClassifieds – Simple Classifieds Plugin
  • Critical 10.0
    CVE-2023-51475

    WordPress WP MLM Unilevel Plugin <= 4.0 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.

    IOSS WP MLM SOFTWARE PLUGIN
  • Critical 9.6
    CVE-2023-51414

    WordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.

    EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters
  • Critical 9.9
    CVE-2023-51422

    WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars,…

    Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
  • Critical 9.9
    CVE-2023-51470

    WordPress Rencontre – Dating Site Plugin <= 3.11.1 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.

    Jacques Malgrange Rencontre – Dating Site
  • Critical 10.0
    CVE-2023-51505

    WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce st…

    RealMag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store Web / CMS
  • Critical 9.6
    CVE-2023-51545

    WordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection

    Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a …

    ThemeHigh Job Manager & Career – Manage job board listings, and recruitments
  • High 7.1
    CVE-2023-7114

    Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attack…

    Mattermost Mattermost
  • Low 3.7
    CVE-2023-7113

    Mattermost Cross-site Scripting vulnerability

    Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 4.9
    CVE-2023-51676

    WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.

    Leevio Happy Addons for Elementor
  • Medium 5.4
    CVE-2023-50878

    WordPress MStore API Plugin <= 4.10.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1.

    inspireui MStore API
  • Medium 4.3
    CVE-2023-50902

    WordPress New User Approve Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1.

    WPExperts.io New User Approve
  • Medium 4.3
    CVE-2023-51354

    WordPress Webba Booking Plugin <= 4.5.33 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking.This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking: from n/a through 4.5.33.

    Webba Plugins Appointment & Event Booking Calendar Plugin – Webba Booking
  • Medium 5.4
    CVE-2023-51358

    WordPress Block IPs for Gravity Forms Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms.This issue affects Block IPs for Gravity Forms: from n/a through 1.0.1.

    Bright Plugins Block IPs for Gravity Forms
  • Medium 5.4
    CVE-2023-51378

    WordPress Rise Blocks Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Rise Themes Rise Blocks – A Complete Gutenberg Page Builder.This issue affects Rise Blocks – A Complete Gutenberg Page Builder: from n/a through 3.1.

    Rise Themes Rise Blocks – A Complete Gutenberg Page Builder
  • Medium 4.3
    CVE-2023-51402

    WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.17 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.17.

    Brainstorm Force Ultimate Addons for WPBakery Page Builder
  • High 8.5
    CVE-2023-7080

    Arbitrary remote code execution within wrangler dev Workers sandbox

    The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect …

    Cloudflare Wrangler wrangler npm
  • Medium 6.4
    CVE-2023-7079

    Arbitrary remote file read in Wrangler dev server

    Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a maliciou…

    Cloudflare Wrangler wrangler npm
  • High 7.5
    CVE-2023-7078

    Server-Side Request Forgery (SSRF) in Miniflare

    Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0),…

    Cloudflare miniflare miniflare npm
  • Medium 6.1
    CVE-2023-44089

    XSS in Visual Console

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 7…

    Pandora FMS Pandora FMS
  • Medium 5.9
    CVE-2023-44088 Public exploit

    SQL Injection in Visual Console

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora …

    Pandora FMS Pandora FMS
  • High 7.5
    CVE-2023-41815

    XSS in File manager

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS: from 700 …

    Pandora FMS Pandora FMS
  • Low 3.7
    CVE-2023-41814

    XSS Vulnerability Messages

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving th…

    Pandora FMS Pandora FMS
  • High 7.6
    CVE-2023-50837

    WordPress Login Lockdown Plugin <= 2.06 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form.This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.

    webfactory Login Lockdown – Protect Login Form
  • Low 3.0
    CVE-2023-41813

    User notification settings edition

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS: from 700 …

    Pandora FMS Pandora FMS
  • Medium 6.5
    CVE-2023-50879

    WordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.

    Automattic WordPress.com Editing Toolkit Web / CMS
  • Medium 6.5
    CVE-2023-50880

    WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.

    The BuddyPress Community BuddyPress
  • Medium 6.5
    CVE-2023-50881

    WordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Re…

    AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
  • Medium 6.5
    CVE-2023-50889

    WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page Builder allows Stored XSS.This issue affects Beaver Builder – WordPress Page Builder: from n/a throug…

    The Beaver Builder Team Beaver Builder – WordPress Page Builder Web / CMS