# CVEs published 2023-08-20

14 CVEs were published on August 20, 2023: 0 critical, 1 high. Days are UTC.

- [CVE-2023-4441](https://cve.now/CVE-2023-4441.md): SourceCodester Free Hospital Management System for Small Practices appointment.php sql injection (CVSS 6.3, SourceCodester Free Hospital Management System for Small Pr…)
- [CVE-2023-4440](https://cve.now/CVE-2023-4440.md): SourceCodester Free Hospital Management System for Small Practices appointment.php sql injection (CVSS 6.3, SourceCodester Free Hospital Management System for Small Pr…)
- [CVE-2023-4439](https://cve.now/CVE-2023-4439.md): SourceCodester Card Holder Management System Minus Value unknown vulnerability (CVSS 4.3, SourceCodester Card Holder Management System)
- [CVE-2023-4438](https://cve.now/CVE-2023-4438.md): SourceCodester Inventory Management System search\_sales\_report.php sql injection (CVSS 6.3, SourceCodester Inventory Management System)
- [CVE-2023-4437](https://cve.now/CVE-2023-4437.md): SourceCodester Inventory Management System search\_sell\_paymen\_report.php sql injection (CVSS 6.3, SourceCodester Inventory Management System)
- [CVE-2023-4436](https://cve.now/CVE-2023-4436.md): SourceCodester Inventory Management System edit\_update.php sql injection (CVSS 6.3, SourceCodester Inventory Management System)
- [CVE-2023-4451](https://cve.now/CVE-2023-4451.md): Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit (CVSS 6.1, cockpit-hq/cockpit)
- [CVE-2023-4435](https://cve.now/CVE-2023-4435.md): Improper Input Validation in hamza417/inure (CVSS 7.7, hamza417/inure)
- [CVE-2023-4434](https://cve.now/CVE-2023-4434.md): Missing Authorization in hamza417/inure (CVSS 5.1, hamza417/inure)
- [CVE-2022-24989](https://cve.now/CVE-2022-24989.md): TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for (no CVSS)
- [CVE-2023-36674](https://cve.now/CVE-2023-36674.md): An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. (no CVSS)
- [CVE-2023-37250](https://cve.now/CVE-2023-37250.md): Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" (no CVSS)
- [CVE-2023-37369](https://cve.now/CVE-2023-37369.md): In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a cr (no CVSS)
- [CVE-2023-40711](https://cve.now/CVE-2023-40711.md): Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attacker (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.