By publication date
Exploited and new serious CVEs: October 2023
107 records · 19 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 2 of 2
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
35Monitor | CVE-2023-45996No exploit | SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive slims · senayan library management system · CWE-89 | High8.8 | — | 1.0% | Oct 31, 2023 |
21Monitor | CVE-2023-46451Proof of concept | Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.mayurik · best courier management system · CWE-79 | Medium5.4 | — | 0.4% | Oct 31, 2023 |
26Monitor | CVE-2023-5412Proof of concept | Image horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcodegopiplus · image horizontal reel scroll slideshow · CWE-89 | Medium6.5 | — | 1.4% | Oct 31, 2023 |
40Plan | CVE-2023-24000Proof of concept | WordPress GamiPress Plugin <= 2.5.7 is vulnerable to SQL Injectiongamipress · gamipress · CWE-89 | Critical9.8 | — | 2.5% | Oct 31, 2023 |
65This week | CVE-2023-5360Weaponized | Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Uploadroyal-elementor-addons · royal elementor addons · CWE-434 | Critical9.8 | — | 86.3% | Oct 31, 2023 |
99Now | CVE-2023-22518Weaponized | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.atlassian · confluence data center · CWE-863 | Critical9.8 | KEV | 99.9% | Oct 31, 2023 |
39Monitor | CVE-2023-3676No exploit | Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationkubernetes · kubernetes · CWE-20 | High8.8 | — | 13.1% | Oct 31, 2023 |
- CVE-2023-4599635Monitor
SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive
HighCVSS 8.8No exploitEPSS 1%slims · senayan library management systemOct 31, 2023
- CVE-2023-4645121Monitor
Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.
MediumCVSS 5.4Proof of conceptEPSS 0%mayurik · best courier management systemOct 31, 2023
- CVE-2023-541226Monitor
Image horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
MediumCVSS 6.5Proof of conceptEPSS 1%gopiplus · image horizontal reel scroll slideshowOct 31, 2023
- CVE-2023-2400040Plan
WordPress GamiPress Plugin <= 2.5.7 is vulnerable to SQL Injection
CriticalCVSS 9.8Proof of conceptEPSS 2%gamipress · gamipressOct 31, 2023
- CVE-2023-536065This week
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8WeaponizedEPSS 86%royal-elementor-addons · royal elementor addonsOct 31, 2023
- CVE-2023-2251899Now
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.
CriticalCVSS 9.8KEVWeaponizedEPSS 99%atlassian · confluence data centerOct 31, 2023
- CVE-2023-367639Monitor
Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
HighCVSS 8.8No exploitEPSS 13%kubernetes · kubernetesOct 31, 2023