CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- seacmsSeaCMS Picture Upload member.php denial of service5.4 Medium
- webkul krayin crmWebkul krayin crm Edit Person Page 2 cross site scripting2.4 Low
- supcon simfield, supcontech simfield firmware +1 moreSupcon SimField reportupload.aspx unrestricted upload4.7 Medium
- tenda ac6, ac6 firmware +1 moreTenda AC6 fromDhcpListClient stack-based overflow6.3 Medium
- comment system project system, sourcecodester comment system +1 moreSourceCodester Comment System GET Parameter index.php cross site scripting3.5 Low
- n158 project n158n158 vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function7.8 High
- keep-module-latest project keep-module-latestkeep-module-latest vulnerable to Command Injection due to missing input sanitization8.4 High
- bwm-ng project bwm-ngbwm-ng vulnerable to command injection8.4 High
- nextcloud mail, kiteworks security-advisories +1 moreBlind SSRF in the Nextcloud Mail app on avatar endpoint3.5 Low
- federicoiosue omni-notes, omninotes omni notes +1 moreUncontrolled data used in content resolution6.3 Medium
- open-emr openemr, openemr openemr/openemr +1 moreCross-site Scripting (XSS) - Stored in openemr/openemr4.7 Medium
- open-emr openemr, openemr openemr/openemr +1 moreImproper Access Control in openemr/openemr6.3 Medium
- open-emr openemr, openemr openemr/openemr +1 moreMissing Authorization in openemr/openemr4.3 Medium
- open-emr openemr, openemr openemr/openemr +1 moreImproper Access Control in openemr/openemr6.3 Medium
- open-emr openemr, openemr openemr/openemr +1 moreCode Injection in openemr/openemr4.6 Medium
- open-emr openemr, openemr openemr/openemr +1 moreImproper Input Validation in openemr/openemr8.1 High
- onelogin ruby-samlruby-saml vulnerable to XPath injection9.8 Critical
- nextcloud server, kiteworks security-advisories +1 moreBasic auth header on WebDAV requests is not brute-force protected in Nextcloud8.1 High
- autolabAutolab tar slip in Install Assessment functionality (`GHSL-2023-081`)6.7 Medium
- autolabAutolab tar slip in cheat checker functionality (`GHSL-2023-082`)6.7 Medium
- fit2cloud cloudexplorer, cloudexplorer-dev cloudexplorer-lite +1 moreUsers can add themselves to any organization in CloudExplorer Lite7.1 High
- fit2cloud cloudexplorer, cloudexplorer-dev cloudexplorer-lite +1 moreThe CloudExplorer Lite missing permissions check7.1 High
- freeswitch sofia-sip, debian linux +1 moreheap-over-flow and integer-overflow in sofia-sip7.5 High
- pomeriumIncorrect Authorization with specially crafted requests10.0 Critical
- nextcloud cookbookNextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command Injection8.1 High
- linuxfoundation rekormalformed proposed intoto v0.0.2 entries can cause a panic in Rekor5.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreUser session not correctly destroyed on logout7.2 High
- made with fuel better notifications for wpWordPress Better Notifications for WP Plugin <= 1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- artistscope copysafe web protectionWordPress CopySafe Web Protection Plugin <= 3.13 is vulnerable to Cross Site Scripting (XSS)7.1 High
- brainstorm force schema – all in one schema rich snippets, brainstormforce schema +1 moreWordPress Schema – All In One Schema Rich Snippets Plugin <= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- boliquan wp clean up, wp clean up project clean up +1 moreWordPress WP Clean Up Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- daniel mores, a. huizinga resize at upload plus, resize at upload plus project at upload plus +1 moreWordPress Resize at Upload Plus Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
hdf5OSS-FuzzHeap-buffer-overflow in H5MM_xstrdupNo score- kubernetes secrets-store-csi-driverKubernetes secrets-store-csi-driver discloses service account tokens in logs6.5 Medium
- iidk-the-actual consoleMinio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited4.3 Medium
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in indexedVolumes5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in review volume5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS XSS in RSS widget feed5.0 Medium
- craftcms cms, craft cms, craftercms +2 moreCraftCMS stored XSS in Quick Post widget error message3.7 Low
- dn88 highlighthighlight vulnerable to cleartext transmission of sensitive information5.4 Medium
- anton skorobogatov rus-to-latWordPress Rus-To-Lat Plugin <= 0.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- utahta wp social bookmarking light, wp social bookmarking light project social bookmarking light +1 moreWordPress WP Social Bookmarking Light Plugin <= 2.0.7 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- wpmaspik maspik, yonifre maspik – spam blacklist +1 moreWordPress Maspik – Spam blacklist Plugin <= 0.7.8 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- conlabz wp google tag managerWordPress WP Google Tag Manager Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- 984.ru for the visually impairedWordPress For the visually impaired Plugin <= 0.58 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- admin block country project block country, theonlinehero - tom skroza admin block country +1 moreWordPress Admin Block Country Plugin <= 7.1.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- sebastian krysmanski upload file type settings plugin, upload file type settings plugin project file type settings plugin +1 moreWordPress Upload File Type Settings Plugin Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- crm perks integration for contact form 7 and zoho crm, bigin, crmperks integration for contact form 7 and zoho crm\, bigin +1 moreWordPress Integration for Contact Form 7 and Zoho CRM, Bigin Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- fixbd educareWordPress Educare – Students & Result Management System Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- uncanny owl toolkit for learndash, uncannyowl uncanny toolkit for learndash +1 moreWordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- Show moreLoading…