# CVEs published 2023-05-07

4 CVEs were published on May 7, 2023: 2 critical, 1 high. Days are UTC.

- [CVE-2023-2565](https://cve.now/CVE-2023-2565.md): SourceCodester Multi Language Hotel Management Software POST Parameter ajax.php cross site scripting (CVSS 3.5, SourceCodester Multi Language Hotel Management Software)
- [CVE-2023-2564](https://cve.now/CVE-2023-2564.md): OS Command Injection in sbs20/scanservjs (CVSS 10.0, sbs20/scanservjs)
- [CVE-2023-31047](https://cve.now/CVE-2023-31047.md): In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploa (CVSS 9.8, django)
- [CVE-2023-32290](https://cve.now/CVE-2023-32290.md): The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.