CVE-2023-0761

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Clock In Portal- Staff & Attendance Management	<= 2.1

References

Timeline

Published: May 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-07624.3The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which c CVE-2023-07634.3The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could CVE-2023-07645.4The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cr CVE-2023-07658.8The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Inject CVE-2023-07668.8The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in us CVE-2023-07678.8An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes CVE-2023-07688.8The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before CVE-2023-07696.1The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, CVE-2023-07707.8Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.CVE-2023-07718.8SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.CVE-2023-07726.5The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actua CVE-2023-07739.8The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remo