Total
419826 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-3191 | 1 Teampass | 1 Teampass | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. | |||||
| CVE-2023-3190 | 1 Teampass | 1 Teampass | 2026-06-17 | N/A | 4.6 MEDIUM |
| Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9. | |||||
| CVE-2023-3189 | 1 Online School Fees System Project | 1 Online School Fees System | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability, which was classified as problematic, was found in SourceCodester Online School Fees System 1.0. This affects an unknown part of the file /paysystem/branch.php of the component POST Parameter Handler. The manipulation of the argument branch leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231501 was assigned to this vulnerability. | |||||
| CVE-2023-3188 | 1 Owncast Project | 1 Owncast | 2026-06-17 | N/A | 6.5 MEDIUM |
| Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0. | |||||
| CVE-2023-3187 | 1 Teachers Record Management System Project | 1 Teachers Record Management System | 2026-06-17 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176. | |||||
| CVE-2023-3186 | 1 Supsystic | 1 Popup | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. | |||||
| CVE-2023-3184 | 1 Sales Tracker Management System Project | 1 Sales Tracker Management System | 2026-06-17 | 3.3 LOW | 2.4 LOW |
| A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save. The manipulation of the argument firstname/middlename/lastname/username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231164. | |||||
| CVE-2023-3183 | 1 Performance Indicator System Project | 1 Performance Indicator System | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was found in SourceCodester Performance Indicator System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/addproduct.php. The manipulation of the argument prodname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231163. | |||||
| CVE-2023-3182 | 1 Liquidweb | 1 Restrict Content | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2023-3181 | 2 Microsoft, Splashtop | 6 Windows, Mirroring360 Receiver, Mirroring360 Sender and 3 more | 2026-06-17 | N/A | 7.8 HIGH |
| The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges. | |||||
| CVE-2023-3180 | 3 Debian, Fedoraproject, Qemu | 3 Debian Linux, Fedora, Qemu | 2026-06-17 | N/A | 6.0 MEDIUM |
| A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. | |||||
| CVE-2023-3179 | 1 Wpexperts | 1 Post Smtp | 2026-06-17 | N/A | 8.8 HIGH |
| The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account). | |||||
| CVE-2023-3178 | 1 Wpexperts | 1 Post Smtp | 2026-06-17 | N/A | 4.3 MEDIUM |
| The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack. | |||||
| CVE-2023-3177 | 1 Oretnom23 | 1 Lost And Found Information System | 2026-06-17 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin\inquiries\view_inquiry.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231151. | |||||
| CVE-2023-3176 | 1 Oretnom23 | 1 Lost And Found Information System | 2026-06-17 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability, which was classified as critical, was found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file admin\user\manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-231150 is the identifier assigned to this vulnerability. | |||||
| CVE-2023-3175 | 1 Quantumcloud | 1 Wpbot | 2026-06-17 | N/A | 4.8 MEDIUM |
| The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2023-3173 | 1 Froxlor | 1 Froxlor | 2026-06-17 | N/A | 9.8 CRITICAL |
| Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. | |||||
| CVE-2023-3172 | 1 Froxlor | 1 Froxlor | 2026-06-17 | N/A | 7.2 HIGH |
| Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. | |||||
| CVE-2023-3171 | 1 Redhat | 2 Enterprise Linux, Jboss Enterprise Application Platform | 2026-06-17 | N/A | 7.5 HIGH |
| A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service. | |||||
| CVE-2023-3170 | 1 Tagdiv | 1 Tagdiv Composer | 2026-06-17 | N/A | 4.8 MEDIUM |
| The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||