# CVEs published 2023-09-17

18 CVEs were published on September 17, 2023: 0 critical, 1 high. Days are UTC.

- [CVE-2023-5030](https://cve.now/CVE-2023-5030.md): Tongda OA delete.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-5029](https://cve.now/CVE-2023-5029.md): mccms 1 sql injection (CVSS 5.5, mccms)
- [CVE-2023-5027](https://cve.now/CVE-2023-5027.md): SourceCodester Simple Membership System club\_validator.php sql injection (CVSS 6.3, SourceCodester Simple Membership System)
- [CVE-2023-5028](https://cve.now/CVE-2023-5028.md): China Unicom TEWA-800G debug log file (CVSS 2.0, China Unicom TEWA-800G)
- [CVE-2023-5026](https://cve.now/CVE-2023-5026.md): Tongda OA cross site scripting (CVSS 3.5, Tongda OA)
- [CVE-2023-5025](https://cve.now/CVE-2023-5025.md): KOHA MARC search.pl cross site scripting (CVSS 3.5, KOHA)
- [CVE-2023-5024](https://cve.now/CVE-2023-5024.md): Planno Comment cross site scripting (CVSS 3.5, Planno)
- [CVE-2023-5023](https://cve.now/CVE-2023-5023.md): Tongda OA delete.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-5022](https://cve.now/CVE-2023-5022.md): DedeCMS select\_templets\_post.php absolute path traversal (CVSS 5.5, DedeCMS)
- [CVE-2023-5021](https://cve.now/CVE-2023-5021.md): SourceCodester AC Repair and Services System cross site scripting (CVSS 3.5, SourceCodester AC Repair and Services System)
- [CVE-2023-38040](https://cve.now/CVE-2023-38040.md): A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. (no CVSS, Revive Adserver)
- [CVE-2023-5020](https://cve.now/CVE-2023-5020.md): 07FLY CRM Administrator Login Page sql injection (CVSS 7.3, 07FLY CRM)
- [CVE-2023-5019](https://cve.now/CVE-2023-5019.md): Tongda OA delete.php sql injection (CVSS 6.3, Tongda OA)
- [CVE-2023-5018](https://cve.now/CVE-2023-5018.md): SourceCodester Lost and Found Information System POST Parameter sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-5017](https://cve.now/CVE-2023-5017.md): lmxcms admin.php sql injection (CVSS 5.5, lmxcms)
- [CVE-2023-5016](https://cve.now/CVE-2023-5016.md): spider-flow API DataSourceController.java DriverManager.getConnection deserialization (CVSS 6.3, spider-flow)
- [CVE-2023-5015](https://cve.now/CVE-2023-5015.md): UCMS cross site scripting (CVSS 3.5, UCMS)
- [CVE-2023-5014](https://cve.now/CVE-2023-5014.md): Sakshi2610 Food Ordering Website categoryfood.php sql injection (CVSS 6.3, Sakshi2610 Food Ordering Website)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.