Total
424956 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-0370 | 1 Wpbean | 1 Wpb Advanced Faq | 2026-06-17 | N/A | 5.4 MEDIUM |
| The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0369 | 1 Gotowp | 1 Gotowp | 2026-06-17 | N/A | 5.4 MEDIUM |
| The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0368 | 1 Responsive Tabs For Wpbakery Page Builder Project | 1 Responsive Tabs For Wpbakery Page Builder | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2023-0367 | 1 Pricing Tables For Wpbakery Page Builder Project | 1 Pricing Tables For Wpbakery Page Builder | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2023-0366 | 1 Quick-plugins | 1 Loan Comparison | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2023-0365 | 1 React Webcam Project | 1 React Webcam | 2026-06-17 | N/A | 5.4 MEDIUM |
| The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0364 | 1 Real.kit Project | 1 Real.kit | 2026-06-17 | N/A | 5.4 MEDIUM |
| The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0363 | 1 Nlb-creations | 1 Scheduled Announcements Widget | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0362 | 1 Themify | 1 Portfolio Post | 2026-06-17 | N/A | 5.4 MEDIUM |
| Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0360 | 1 Shapedplugin | 1 Location Weather | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0359 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 5.9 MEDIUM |
| A missing nullptr-check in handle_ra_input can cause a nullptr-deref. | |||||
| CVE-2023-0358 | 1 Gpac | 1 Gpac | 2026-06-17 | N/A | 7.8 HIGH |
| Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV. | |||||
| CVE-2023-0357 | 1 Helpy.io | 1 Helpy | 2026-06-17 | N/A | 6.1 MEDIUM |
| Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the application does not correctly validate the attachments sent by customers in the ticket. | |||||
| CVE-2023-0356 | 1 Socomec | 2 Modulys Gp, Net Vision | 2026-06-17 | N/A | 5.7 MEDIUM |
| SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive information. | |||||
| CVE-2023-0355 | 1 Akuvox | 2 E11, E11 Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information. | |||||
| CVE-2023-0354 | 1 Akuvox | 2 E11, E11 Firmware | 2026-06-17 | N/A | 9.1 CRITICAL |
| The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs. | |||||
| CVE-2023-0353 | 1 Akuvox | 2 E11, E11 Firmware | 2026-06-17 | N/A | 7.2 HIGH |
| Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file. | |||||
| CVE-2023-0352 | 1 Akuvox | 2 E11, E11 Firmware | 2026-06-17 | N/A | 9.1 CRITICAL |
| The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use this page to reset the password back to the default. | |||||
| CVE-2023-0351 | 1 Akuvox | 2 E11, E11 Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions. | |||||
| CVE-2023-0350 | 1 Akuvox | 2 E11, E11 Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| Akuvox E11 does not ensure that a file extension is associated with the file provided. This could allow an attacker to upload a file to the device by changing the extension of a malicious file to an accepted file type. | |||||