# CVEs published 2023-09-30 56 CVEs were published on September 30, 2023: 3 critical, 3 high. Days are UTC. - [CVE-2023-5112](https://cve.now/CVE-2023-5112.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-5111](https://cve.now/CVE-2023-5111.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43735](https://cve.now/CVE-2023-43735.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43734](https://cve.now/CVE-2023-43734.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43733](https://cve.now/CVE-2023-43733.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43732](https://cve.now/CVE-2023-43732.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43731](https://cve.now/CVE-2023-43731.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43730](https://cve.now/CVE-2023-43730.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43729](https://cve.now/CVE-2023-43729.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43728](https://cve.now/CVE-2023-43728.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43727](https://cve.now/CVE-2023-43727.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43726](https://cve.now/CVE-2023-43726.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43725](https://cve.now/CVE-2023-43725.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43724](https://cve.now/CVE-2023-43724.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43723](https://cve.now/CVE-2023-43723.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43722](https://cve.now/CVE-2023-43722.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43721](https://cve.now/CVE-2023-43721.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43720](https://cve.now/CVE-2023-43720.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43719](https://cve.now/CVE-2023-43719.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43718](https://cve.now/CVE-2023-43718.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43717](https://cve.now/CVE-2023-43717.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43716](https://cve.now/CVE-2023-43716.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43715](https://cve.now/CVE-2023-43715.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43714](https://cve.now/CVE-2023-43714.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43713](https://cve.now/CVE-2023-43713.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43712](https://cve.now/CVE-2023-43712.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2022-4956](https://cve.now/CVE-2022-4956.md): Caphyon Advanced Installer WinSxS DLL uncontrolled search path (CVSS 7.8, Caphyon Advanced Installer) - [CVE-2023-5313](https://cve.now/CVE-2023-5313.md): phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique action (CVSS 5.3, phpkobo Ajax Poll Script) - [CVE-2023-5305](https://cve.now/CVE-2023-5305.md): Online Banquet Booking System Contact Us Page mail.php cross site scripting (CVSS 3.5, Online Banquet Booking System) - [CVE-2023-5304](https://cve.now/CVE-2023-5304.md): Online Banquet Booking System Service Booking book-services.php cross site scripting (CVSS 3.5, Online Banquet Booking System) - [CVE-2023-5321](https://cve.now/CVE-2023-5321.md): Missing Authorization in hamza417/inure (CVSS 5.1, hamza417/inure) - [CVE-2023-5303](https://cve.now/CVE-2023-5303.md): Online Banquet Booking System Account Detail view-booking-detail.php cross site scripting (CVSS 3.5, Online Banquet Booking System) - [CVE-2023-5302](https://cve.now/CVE-2023-5302.md): SourceCodester Best Courier Management System Manage Account Page cross site scripting (CVSS 3.5, SourceCodester Best Courier Management System) - [CVE-2023-5301](https://cve.now/CVE-2023-5301.md): DedeCMS album\_add.php AddMyAddon os command injection (CVSS 4.7, DedeCMS) - [CVE-2023-5300](https://cve.now/CVE-2023-5300.md): TTSPlanning sql injection (CVSS 6.3, TTSPlanning) - [CVE-2023-5207](https://cve.now/CVE-2023-5207.md): Execution with Unnecessary Privileges in GitLab (CVSS 8.2, GitLab) - [CVE-2023-5298](https://cve.now/CVE-2023-5298.md): Tongda OA 2017 delete.php sql injection (CVSS 5.5, Tongda OA) - [CVE-2023-5295](https://cve.now/CVE-2023-5295.md): Comments by Startbit \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, vivacityinfotechjaipur Comments by Startbit) - [CVE-2023-5201](https://cve.now/CVE-2023-5201.md): OpenHook \<= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode (CVSS 9.9, brazenlygeek OpenHook) - [CVE-2023-43711](https://cve.now/CVE-2023-43711.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43710](https://cve.now/CVE-2023-43710.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43709](https://cve.now/CVE-2023-43709.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43708](https://cve.now/CVE-2023-43708.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43707](https://cve.now/CVE-2023-43707.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43706](https://cve.now/CVE-2023-43706.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43705](https://cve.now/CVE-2023-43705.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43704](https://cve.now/CVE-2023-43704.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43703](https://cve.now/CVE-2023-43703.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-43702](https://cve.now/CVE-2023-43702.md): Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) (CVSS 5.4, Os Commerce) - [CVE-2023-5320](https://cve.now/CVE-2023-5320.md): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (CVSS 9.0, thorsten/phpmyfaq) - [CVE-2023-5317](https://cve.now/CVE-2023-5317.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.3, thorsten/phpmyfaq) - [CVE-2023-5318](https://cve.now/CVE-2023-5318.md): Use of Hard-coded Credentials in microweber/microweber (CVSS 5.8, microweber/microweber) - [CVE-2023-5316](https://cve.now/CVE-2023-5316.md): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (CVSS 9.1, thorsten/phpmyfaq) - [CVE-2023-5319](https://cve.now/CVE-2023-5319.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.3, thorsten/phpmyfaq) - [CVE-2023-5227](https://cve.now/CVE-2023-5227.md): Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq (CVSS 6.5, thorsten/phpmyfaq) - [CVE-2023-44488](https://cve.now/CVE-2023-44488.md): VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-09-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.