CVEs published in February 2023
2,729 vulnerabilities, 255 critical, 10 exploited.
- geonodeXML External Entity (XXE) injection in GeoServer style upload functionality6.5 Medium
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured2.6 Low
- correos oficial, unknown correos oficial +1 moreCorreos Oficial <= 1.2.0.2 - Unauthenticated Arbitrary File Download7.5 High
- add user project user, unknown custom add user +1 moreCustom Add User <= 2.0.2 - Reflected Cross-Site Scripting6.1 Medium
- paolo geodirectoryGeoDirectory < 2.2.24 - Admin+ SQLi7.2 High
- premio my sticky elements, unknown all-in-one floating contact form, call, chat, and 50+ social icon tabs +1 moreMy Sticky Elements < 2.0.9 - Admin+ SQLi7.2 High
- david lingren media library assistant, media library assistant project library assistant +1 moreMedia Library Assistant < 3.06 - Admin+ SQLi7.2 High
- bharatkambariya donation block for paypal, donation block for paypal project block for paypal +1 moreDonation Block For PayPal < 2.1.0 - Contributor+ Stored XSS5.4 Medium
- unknown wufoo shortcode, wufoo shortcode +1 moreWufoo Shortcode < 1.52 - Contributor+ Stored XSS via Shortcode5.4 Medium
- unknown user activity, user activity project activity +1 moreUser Activity <= 1.0.1 - IP Spoofing7.5 High
- gsplugins gs insever portfolioGS Insever Portfolio < 1.4.5 - Contributor+ Stored XSS5.4 Medium
- bob arigato autoresponder and newsletterArigato Autoresponder and Newsletter < 2.1.7.2 - Admin+ Stored XSS4.8 Medium
- embed pdf project pdf, unknown embed pdf +1 moreEmbed PDF <= 1.0.6 - Contributor+ Stored XSS via Shortcode5.4 Medium
- olevmedia shortcodes, unknown olevmedia shortcodes +1 moreOlevmedia Shortcodes <= 1.1.9 - Contributor+ Stored XSS5.4 Medium
- tri gigpressGigPress <= 2.3.28 - Subscriber+ SQLi8.8 High
- genetechsolutions pie register, unknown registration forms +1 morePie Register < 3.8.2.3 - Open Redirect5.4 Medium
- list pages shortcode project pages shortcode, unknown list pages shortcode +1 moreList Pages Shortcode < 1.7.6 - Contributor+ Stored XSS via Shortcode5.4 Medium
- unknown show-hide / collapse-expand, show-hide \/ collapse-expand project \/ collapse-expand +1 moreShow-Hide / Collapse-Expand < 1.3.0 - Contributor+ Stored XSS via Shortcode5.4 Medium
- unknown namaste! lms, kibokolabs namaste\! lms +1 moreNamaste! LMS < 2.5.9.4 - Admin+ Stored XSS4.8 Medium
- galleries by angie makes project by angie makes, unknown galleries by angie makes +1 moreGalleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode5.4 Medium
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit < 9.86.0.0 - Contributor+ Stored XSS5.4 Medium
- shortpixel adaptive images, unknown shortpixel adaptive images +1 moreShortPixel Adaptive Images < 3.6.3 - Reflected XSS6.1 Medium
- mattermost, mattermost server +1 moreDisclosure of team owner email address when when accessing the teams API2.7 Low
- mattermost, mattermost server +1 moreDisclosure of team owner email address when regenerating Invite ID2.7 Low
- mattermostIDOR: Updating a playbook via the Playbooks API7.1 High
- mattermostIDOR: Accessing playbook runs via the Playbooks Runs API4.3 Medium
- part-db project part-db, part-db part-db-server +1 moreHTML/XSS injection possibilities in Part-DB6.1 Medium
- wago 751-9301 firmware, 752-8303\/8000-002 firmware, compact controller cc100 (751-9301) +11 more +13 moreWAGO: Missing Authentication for Critical Function9.8 Critical
- wago 751-9301 firmware, 752-8303\/8000-002 firmware, compact controller cc100 (751-9301) +11 more +13 moreWAGO: Origin validation error through CORS misconfiguration5.3 Medium
- wago 751-9301 firmware, 752-8303\/8000-002 firmware, compact controller cc100 (751-9301) +11 more +13 moreWAGO: Missing Authentication for Critical Function9.8 Critical
- wago 751-9301 firmware, 752-8303\/8000-002 firmware, compact controller cc100 (751-9301) +11 more +13 moreWAGO: Reflective Cross-Site Scripting6.1 Medium
- ibm cloud pak for business automationIBM Cloud Pak for Business Automation cross-site scripting5.4 Medium
- ibm mq for hpe nonstopIBM MQ for HPE NonStop denial of service6.5 Medium
- read more excerpt link project more excerpt link, teckel read more excerpt link +1 moreDownload Read More Excerpt Link <= 1.6.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- doctors appointment system project appointment system, sourcecodester doctors appointment system +1 moreSourceCodester Doctors Appointment System Parameter patient.php sql injection6.3 Medium
- doctors appointment system project appointment system, sourcecodester doctors appointment system +1 moreSourceCodester Doctors Appointment System Parameter add-new.php sql injection6.3 Medium
- doctors appointment system project appointment system, sourcecodester doctors appointment system +1 moreSourceCodester Doctors Appointment System edit-doc.php sql injection5.3 Medium
- doctors appointment system project appointment system, sourcecodester doctors appointment system +1 moreSourceCodester Doctors Appointment System Parameter doctors.php sql injection5.3 Medium
- doctors appointment system project appointment system, sourcecodester doctors appointment system +1 moreSourceCodester Doctors Appointment System create-account.php sql injection7.3 High
- doctors appointment system project appointment system, sourcecodester doctors appointment system +1 moreSourceCodester Doctors Appointment System login.php edoc sql injection5.5 Medium
- doctors appointment system project appointment system, sourcecodester doctors appointment system +1 moreSourceCodester Doctors Appointment System patient.php sql injection6.3 Medium
- music gallery site project gallery site, sourcecodester music gallery site +1 moreSourceCodester Music Gallery Site sql injection4.7 Medium
- music gallery site project gallery site, sourcecodester music gallery site +1 moreSourceCodester Music Gallery Site view_category.php sql injection4.7 Medium
- fortinet fortiwebAn unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0...6.6 Medium
- spip, debian linux +1 moreSPIP before 4.2.1 allows Remote Code Execution via form values in the public area because...9.8 Critical
- smeup erpSme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability.8.8 High
- smeup erpSme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability...7.5 High
- smeup erpSme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via...8.8 High
- smeup erpSme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via...7.5 High
- abus tvip 20000-21150 firmwareABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell...7.2 High
- Show moreLoading…