# CVEs published 2023-09-09

15 CVEs were published on September 9, 2023: 0 critical, 0 high. Days are UTC.

- [CVE-2023-4866](https://cve.now/CVE-2023-4866.md): SourceCodester Online Tours & Travels Management System booking.php exec sql injection (CVSS 6.3, SourceCodester Online Tours & Travels Management System)
- [CVE-2023-4865](https://cve.now/CVE-2023-4865.md): SourceCodester Take-Note App cross-site request forgery (CVSS 4.3, SourceCodester Take-Note App)
- [CVE-2023-4864](https://cve.now/CVE-2023-4864.md): SourceCodester Take-Note App index.php cross site scripting (CVSS 3.5, SourceCodester Take-Note App)
- [CVE-2023-4874](https://cve.now/CVE-2023-4874.md): Undefined Behavior for Input to API in Mutt (CVSS 4.3, Mutt)
- [CVE-2023-4875](https://cve.now/CVE-2023-4875.md): Undefined Behavior for Input to API in Mutt (CVSS 2.2, Mutt)
- [CVE-2023-4852](https://cve.now/CVE-2023-4852.md): IBOS OA optimize sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-4851](https://cve.now/CVE-2023-4851.md): IBOS OA edit&op=member sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-4850](https://cve.now/CVE-2023-4850.md): IBOS OA del sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-4849](https://cve.now/CVE-2023-4849.md): IBOS OA trash&op=del sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-4848](https://cve.now/CVE-2023-4848.md): SourceCodester Simple Book Catalog App delete\_book.php sql injection (CVSS 6.3, SourceCodester Simple Book Catalog App)
- [CVE-2023-4847](https://cve.now/CVE-2023-4847.md): SourceCodester Simple Book Catalog App Update Book Form cross site scripting (CVSS 3.5, SourceCodester Simple Book Catalog App)
- [CVE-2023-4846](https://cve.now/CVE-2023-4846.md): SourceCodester Simple Membership System delete\_member.php sql injection (CVSS 6.3, SourceCodester Simple Membership System)
- [CVE-2023-4845](https://cve.now/CVE-2023-4845.md): SourceCodester Simple Membership System account\_edit\_query.php sql injection (CVSS 6.3, SourceCodester Simple Membership System)
- [CVE-2023-4838](https://cve.now/CVE-2023-4838.md): The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, (CVSS 6.4, specialk Simple Download Counter)
- [CVE-2023-41915](https://cve.now/CVE-2023-41915.md): OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execut (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.