CVE-2023-37847: novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
Published Aug 14, 2023 · Updated Jul 9, 2026
CVE archive
2023 CVE Archive
Browse CVE records published in 2023 CVE Archive, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 30600 matching CVEs · Page 5 of 612.
CVE-2023-37798: A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt...
A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter.
Published Sep 7, 2023 · Updated Jul 9, 2026
CVE-2023-37733: An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code vi...
An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.
Published Jul 19, 2023 · Updated Jul 9, 2026
CVE-2023-37728: IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.
IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.
Published Jul 20, 2023 · Updated Jul 9, 2026
CVE-2023-37690: Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Search Ma...
Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Search Maid page.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37689: Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Booking R...
Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Booking Request page.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37688: Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page.
Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37687: Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the...
Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the View Request of Nurse Page in the Admin portal.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37686: Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the...
Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Nurse Page in the Admin portal.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37685: Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the...
Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Page of the Admin portal.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37684: Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the...
Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Details of the Admin portal.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37683: Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the...
Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Profile Page of the Admin.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37679: A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute...
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.
Published Aug 3, 2023 · Updated Jul 9, 2026
CVE-2023-37647: SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.
Published Jul 31, 2023 · Updated Jul 9, 2026
CVE-2023-37646: An issue in the CAB file extraction function of Bitberry File Opener v23.0 allows attackers to execute a di...
An issue in the CAB file extraction function of Bitberry File Opener v23.0 allows attackers to execute a directory traversal.
Published Aug 8, 2023 · Updated Jul 9, 2026
CVE-2023-37608: An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensi...
An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its hardcoded password.
Published Jan 3, 2024 · Updated Jul 9, 2026
CVE-2023-37607: Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to o...
Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.
Published Jan 3, 2024 · Updated Jul 9, 2026
CVE-2023-37058: Insecure Permissions vulnerability in JLINK Unionman Technology Co.
Insecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to escalate privileges via a crafted command.
Published Jun 17, 2024 · Updated Jul 9, 2026
CVE-2023-37057: An issue in JLINK Unionman Technology Co.
An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentication mechanism.
Published Jun 17, 2024 · Updated Jul 9, 2026
CVE-2023-36361: Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.
Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.
Published Sep 5, 2023 · Updated Jul 9, 2026
CVE-2023-36255: An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to exe...
An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.
Published Aug 3, 2023 · Updated Jul 9, 2026
CVE-2023-36223: Cross Site Scripting vulnerability in mlogclub bbs-go v.
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function.
Published Jul 3, 2023 · Updated Jul 9, 2026
CVE-2023-36222: Cross Site Scripting vulnerability in mlogclub bbs-go v.
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.
Published Jul 3, 2023 · Updated Jul 9, 2026
CVE-2023-36177: An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary cod...
An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.
Published Jan 23, 2024 · Updated Jul 9, 2026
CVE-2023-36159: Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows rem...
Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.
Published Aug 3, 2023 · Updated Jul 9, 2026
CVE-2023-36158: Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote att...
Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.
Published Aug 3, 2023 · Updated Jul 9, 2026
CVE-2023-36146: A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
Published Jun 30, 2023 · Updated Jul 9, 2026
CVE-2023-36144: An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attac...
An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.
Published Jun 30, 2023 · Updated Jul 9, 2026
CVE-2023-36143: Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" function...
Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device.
Published Jun 30, 2023 · Updated Jul 9, 2026
CVE-2023-36095: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python...
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
Published Aug 5, 2023 · Updated Jul 9, 2026
CVE-2023-36088: Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attacke...
Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
Published Sep 1, 2023 · Updated Jul 9, 2026
CVE-2023-36082: An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges vi...
An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.
Published Aug 3, 2023 · Updated Jul 9, 2026
CVE-2023-36081: Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote at...
Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code via a crafted script to the web application dashboard.
Published Aug 2, 2023 · Updated Jul 9, 2026
CVE-2023-34960: A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows at...
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
Published Aug 1, 2023 · Updated Jul 9, 2026
CVE-2023-34944: An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.1...
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
Published Jun 13, 2023 · Updated Jul 9, 2026
CVE-2023-34842: Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary cod...
Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.
Published Jul 31, 2023 · Updated Jul 9, 2026
CVE-2023-34840: angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) v...
angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
Published Jun 30, 2023 · Updated Jul 9, 2026
CVE-2023-34832: TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8...
TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.
Published Jun 16, 2023 · Updated Jul 9, 2026
CVE-2023-34752: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/ind...
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.
Published Jun 14, 2023 · Updated Jul 9, 2026
CVE-2023-34673: Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and othe...
Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases.
Published Jun 23, 2023 · Updated Jul 9, 2026
CVE-2023-34672: Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter runnin...
Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile. An attack could occur over the public Internet in some cases.
Published Jun 23, 2023 · Updated Jul 9, 2026
CVE-2023-34671: Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on ver...
Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role in the user profile. An attack could occur over the public Internet in some cases.
Published Jun 23, 2023 · Updated Jul 9, 2026
CVE-2023-34552: In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_...
In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions of the SADP multicast protocol can allow an unauthenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214.
Published Aug 1, 2023 · Updated Jul 9, 2026
CVE-2023-34551: In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK comm...
In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214. The impact is: execute arbitrary code (remote).
Published Aug 1, 2023 · Updated Jul 9, 2026
CVE-2023-33782: D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnost...
D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.
Published Jun 7, 2023 · Updated Jul 9, 2026
CVE-2023-33781: An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted...
An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.
Published Jun 7, 2023 · Updated Jul 9, 2026
CVE-2023-33779: A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands o...
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
Published May 26, 2023 · Updated Jul 9, 2026
CVE-2023-24282: An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary c...
An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a crafted ringtone file.
Published Mar 8, 2023 · Updated Jul 9, 2026
CVE-2023-24188: ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function whic...
ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.
Published Feb 13, 2023 · Updated Jul 9, 2026
CVE-2023-24187: An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via...
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
Published Feb 14, 2023 · Updated Jul 9, 2026