CVE-2023-33331

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-333326.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.CVE-2023-333338.8Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-SitCVE-2023-333356.1Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be eCVE-2023-333364.8Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inpuCVE-2023-333389.8Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.CVE-2023-33355.5Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users  to gain sensCVE-2023-333557.5IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information.CVE-2023-333565.4IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-333594.3Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.CVE-2023-33365.3TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attackerCVE-2023-333619.8Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.CVE-2023-333629.8Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.