Total
421301 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-2764 | 1 Nsqua | 1 Draw Attention | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set_featured_image function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the featured image of arbitrary posts with an image that exists in the media library. | |||||
| CVE-2023-2763 | 1 3ds | 1 3dexperience Solidworks | 2026-06-17 | N/A | 7.8 HIGH |
| Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file. | |||||
| CVE-2023-2762 | 1 3ds | 1 3dexperience Solidworks | 2026-06-17 | N/A | 7.8 HIGH |
| A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file. | |||||
| CVE-2023-2761 | 1 Solwininfotech | 1 User Activity Log | 2026-06-17 | N/A | 7.2 HIGH |
| The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin. | |||||
| CVE-2023-2760 | 1 Taphome | 2 Core, Core Firmware | 2026-06-17 | N/A | 7.6 HIGH |
| An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version 2023.2, allowing low privileged users to inject arbitrary SQL directives into an SQL query and execute arbitrary SQL commands and get full reading access. This may also lead to limited write access and temporary Denial-of-Service. | |||||
| CVE-2023-2759 | 1 Taphome | 2 Core, Core Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability. | |||||
| CVE-2023-2758 | 1 Contec | 1 Conprosys Hmi System | 2026-06-17 | N/A | 3.7 LOW |
| A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time. | |||||
| CVE-2023-2757 | 1 Plugin | 1 Waiting | 2026-06-17 | N/A | 7.4 HIGH |
| The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versions up to, and including, 0.6.2. This could lead to Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for subscriber-level attackers to access functions to save plugin data that can potentially lead to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-2756 | 1 Pimcore | 1 Customer Management Framework | 2026-06-17 | N/A | 7.2 HIGH |
| SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10. | |||||
| CVE-2023-2754 | 1 Cloudflare | 1 Warp | 2026-06-17 | N/A | 7.4 HIGH |
| The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device. | |||||
| CVE-2023-2753 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. | |||||
| CVE-2023-2752 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. | |||||
| CVE-2023-2751 | 1 Upload Resume Project | 1 Upload Resume | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form shortcode, allowing unauthenticated visitors to upload arbitrary media files to the site. | |||||
| CVE-2023-2750 | 1 Cityboss | 1 E-municipality | 2026-06-17 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cityboss E-municipality allows SQL Injection. This issue affects E-municipality: before 6.05. | |||||
| CVE-2023-2749 | 1 Asustor | 2 Adm, Download Center | 2026-06-17 | N/A | 8.6 HIGH |
| Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below. | |||||
| CVE-2023-2747 | 1 Silabs | 1 Gecko Software Development Kit | 2026-06-17 | N/A | 3.1 LOW |
| The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized. | |||||
| CVE-2023-2746 | 1 Rockwellautomation | 1 Enhanced Him | 2026-06-17 | N/A | 9.6 CRITICAL |
| The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). Exploitation of a CSRF could potentially lead to sensitive information disclosure and full remote access to the affected products. | |||||
| CVE-2023-2745 | 1 Wordpress | 1 Wordpress | 2026-06-17 | N/A | 5.4 MEDIUM |
| WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack. | |||||
| CVE-2023-2744 | 1 Wedevs | 1 Wp Erp | 2026-06-17 | N/A | 7.2 HIGH |
| The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. | |||||
| CVE-2023-2743 | 1 Wedevs | 1 Wp Erp | 2026-06-17 | N/A | 6.1 MEDIUM |
| The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | |||||