Week 35, 2023
28 August to 3 September 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 463CVEs publishedin the whole week
- 83CriticalCVSS 9.0 and above
- 133HighCVSS 7.0 to 8.9
- 0Added to KEVknown exploited, newly listed
Most severe new CVEsBy CVSS score
- CVE-2023-1523
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary…
Canonical Ltd. · snapd
Critical10.0 - CVE-2023-3703
Proscend Advice ICR Series routers fw version 1.76
Proscend Advice · ICR Series routers FW
Critical10.0 - CVE-2023-34039
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with…
Aria Operations for Networks
Critical9.8 - CVE-2023-41109
SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.
Product not named
Critical9.8 - CVE-2023-40787
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
Product not named
Critical9.8 - CVE-2023-4596
Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload
wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Critical9.8 - CVE-2023-31714
Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
Product not named
Critical9.8 - CVE-2023-39560
ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.
Product not named
Critical9.8 - CVE-2023-39650
Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.
Product not named
Critical9.8 - CVE-2023-40749
PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php.
Product not named
Critical9.8