CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- ipushpull live updates from excelLive updates from Excel <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- netmove corporation saat netizen, saat netizen installer, saat netizen +1 more +3 moreImproper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and...8.1 High
- jonashjalmarsson html filter and csv-file searchHTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- dbbee idbbeeidbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode5.4 Medium
- jrbecart iframe formsiframe forms <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframe Shortcode6.4 Medium
- syska led lights pvt ltd sw100 smartwatch, syska sw100 smartwatch firmware +1 moreUnauthorized Access Vulnerability in Syska SW100 Smartwatch8.1 High
- adrian tobey groundhoggWordPress Groundhogg Plugin <= 2.7.11.10 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- ollybach wppizza – a restaurant plugin, wp-pizza wppizza +1 moreWordPress WPPizza Plugin <= 3.18.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- katie seaborn zotpressWordPress Zotpress Plugin <= 7.3.4 is vulnerable to Cross Site Scripting (XSS)7.1 High
- line corporation line@ for android, line@ for ios, line line\@ +2 moreLINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in...5.9 Medium
- line, line corporation for android, for ios +2 moreLINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are...5.9 Medium
- zaytech smart online order for cloverWordPress Smart Online Order for Clover Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)7.1 High
- gopiplus vertical marquee pluginVertical marquee plugin <= 7.1 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus message tickerMessage ticker <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus wp image slideshowwp image slideshow <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus wp fade in text newsWP fade in text news <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus left right image slideshow galleryLeft right image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus information reelInformation Reel <= 10.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus wp photo text slider 50Wp photo text slider 50 <= 8.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus jquery news tickerJquery news ticker <= 3.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus up down image slideshow galleryUp down image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus superb slideshow gallerySuperb slideshow gallery <= 13.1 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopi plus jquery accordion slideshowJquery accordion slideshow <= 8.1 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopi ramasamy image horizontal reel scroll slideshowImage horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- gopiplus image vertical reel scroll slideshowImage vertical reel scroll slideshow <= 9.0 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Stored in pimcore/pimcore4.0 Medium
- webcource wc captchaWordPress WC Captcha Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq6.3 Medium
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Stored in thorsten/phpmyfaq4.6 Medium
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreInsufficient Session Expiration in thorsten/phpmyfaq7.6 High
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Stored in thorsten/phpmyfaq7.4 High
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq7.4 High
- hamza417 hamza417/inure, inure +1 moreMissing Authorization in hamza417/inure5.1 Medium
- microweber, microweber microweber/microweber +1 moreCross-site Scripting (XSS) - Stored in microweber/microweber6.4 Medium
- thorntech sftp gateway, sftp gateway firmware +1 moreThorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of...9.8 Critical
- virtualminAn issue was discovered in Virtualmin 7.7. The Create Virtual Server functionality allows XSS...5.4 Medium
- virtualminAn issue was discovered in Virtualmin 7.7. A Stored Cross-Site Scripting (XSS) vulnerability...4.8 Medium
- virtualminAn issue was discovered in Virtualmin 7.7. The Server Templates feature under System Settings...5.4 Medium
- virtualminAn issue was discovered in Virtualmin 7.7. The Cloudmin Services Client under System Settings...5.4 Medium
- virtualminAn issue was discovered in Virtualmin 7.7. The Custom Fields feature of Edit Virtual Server under...5.4 Medium
- virtualminAn issue was discovered in Virtualmin 7.7. A Stored Cross-Site Scripting (XSS) vulnerability was...5.4 Medium
- totolink a3300r firmwareIn TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no...9.8 Critical
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are...7.5 High
- totolink x6000r firmwareTOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection...9.8 Critical
- totolink x6000r firmwareTOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can...7.5 High
- totolink lr1200gb firmwareTOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the...9.8 Critical
- totolink a3300r firmwareTOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter...9.8 Critical
- totolink x6000r firmwareAn issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary...9.8 Critical
- totolink x6000r firmwareAn issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary...9.8 Critical
- mayurik best courier management systemBest Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change...5.4 Medium
- Show moreLoading…