CVE-2023-2206

Campcodes Retro Basketball Shoes Online Store contactus.php sql injection

A vulnerability classified as critical has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file contactus.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226971.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Retro Basketball Shoes Online Store

CVE-2023-2204

Campcodes Retro Basketball Shoes Online Store faqs.php sql injection

A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file faqs.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226969 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Retro Basketball Shoes Online Store

CVE-2023-2200

Improper Encoding or Escaping of Output in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2023-2190

Authorization Bypass Through User-Controlled Key in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2023-2156

kernel: net: IPv6 RPL protocol reachable assertion leads to DoS

A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system.

CVSS 3.1 · 7.5 High EPSS 6.2% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 1 more

CVE-2023-2154

SourceCodester Task Reminder System sql injection

A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/?page=reminders/view_reminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226275.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Task Reminder System Project

Products

Task Reminder System

CVE-2023-2153

SourceCodester Complaint Management System POST Parameter editable_ajax.php cross site scripting

A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php of the component POST Parameter Handler. The manipulation of the argument value with the input 1><script>alert(666)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226274 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Complaint Management System Project

Products

Complaint Management System

CVE-2023-2152

SourceCodester Student Study Center Desk Management System index.php file inclusion

A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was assigned to this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Oretnom23

Products

Student Study Center Desk Management System

CVE-2023-2151

SourceCodester Student Study Center Desk Management System manage_student.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226272.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Student Study Center Desk Management System

CVE-2023-2150

SourceCodester Task Reminder System Master.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Task Reminder System 1.0. This issue affects some unknown processing of the file Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226271.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Task Reminder System Project

Products

Task Reminder System

CVE-2023-2147

Campcodes Online Thesis Archiving System view_details.php sql injection

A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/students/view_details.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226268.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Thesis Archiving System Project

Products

Online Thesis Archiving System

CVE-2023-2146

Campcodes Online Thesis Archiving System Master.php sql injection

A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226267.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Thesis Archiving System Project

Products

Online Thesis Archiving System

CVE-2023-2145

Campcodes Online Thesis Archiving System projects_per_curriculum.php sql injection

A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been classified as critical. Affected is an unknown function of the file projects_per_curriculum.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226266 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Thesis Archiving System Project

Products

Online Thesis Archiving System

CVE-2023-2143

Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS

The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ideastocode

Products

Enable Svg\, Webp \& Ico Upload

CVE-2023-2130

SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 4.1% KEV · Not listed

Vendors

Purchase Order Management System Project

Products

Purchase Order Management System

CVE-2023-2124

kernel: OOB access in the Linux kernel's XFS subsystem

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel H300s and 15 more

CVE-2023-2123

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Wpinventory

Products

Wp Inventory Manager

CVE-2023-2122

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

10web

Products

Image Optimizer

CVE-2023-2110

Obsidian Local File Disclosure

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft and 1 more

Products

Macos Linux Kernel Windows and 1 more

CVE-2023-2108

SourceCodester Judging Management System edit_contestant.php sql injection

A vulnerability has been found in SourceCodester Judging Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_contestant.php. The manipulation of the argument contestant_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226147.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Judging Management System Project

Products

Judging Management System