CVE-2023-0381

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-03826.5User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumpti CVE-2023-03837.5User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumpti CVE-2023-03847.5User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumpti CVE-2023-03854.3The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to CVE-2023-03867.8A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux CVE-2023-03888.8The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading CVE-2023-03894.8The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high pr CVE-2023-03918.1MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every i CVE-2023-03926.7The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.CVE-2023-03945.5A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. Th CVE-2023-03955.4The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page CVE-2023-03966.8A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.