# CVEs published 2024-01-01

15 CVEs were published on January 1, 2024: 1 critical, 7 high. Days are UTC.

- [CVE-2024-0184](https://cve.now/CVE-2024-0184.md): RRJ Nueva Ecija Engineer Online Portal Add Enginer edit\_teacher.php cross site scripting (CVSS 2.4, RRJ Nueva Ecija Engineer Online Portal)
- [CVE-2024-0183](https://cve.now/CVE-2024-0183.md): RRJ Nueva Ecija Engineer Online Portal NIA Office students.php cross site scripting (CVSS 2.4, RRJ Nueva Ecija Engineer Online Portal)
- [CVE-2024-0182](https://cve.now/CVE-2024-0182.md): SourceCodester Engineers Online Portal Admin Login sql injection (CVSS 7.3, SourceCodester Engineers Online Portal)
- [CVE-2024-0181](https://cve.now/CVE-2024-0181.md): RRJ Nueva Ecija Engineer Online Portal Admin Panel admin\_user.php cross site scripting (CVSS 2.4, RRJ Nueva Ecija Engineer Online Portal)
- [CVE-2023-6113](https://cve.now/CVE-2023-6113.md): WP Staging (Free \< 3.1.3, Pro \< 5.1.3) - Unauthenticated Backup Download (CVSS 7.5, WP STAGING WordPress Backup Plugin · WP STAGING Pro WordPre…)
- [CVE-2023-5877](https://cve.now/CVE-2023-5877.md): affiliate-toolkit \< 3.4.3 - Unauthenticated SSRF (CVSS 9.8, affiliate-toolkit)
- [CVE-2023-6037](https://cve.now/CVE-2023-6037.md): WP TripAdvisor Review Slider \< 11.9 - Admin+ Stored XSS (CVSS 4.8, WP TripAdvisor Review Slider)
- [CVE-2023-6000](https://cve.now/CVE-2023-6000.md): Popup Builder \< 4.2.3 - Unauthenticated Stored XSS (CVSS 6.1, Popup Builder)
- [CVE-2023-6485](https://cve.now/CVE-2023-6485.md): Html5 Video Player \< 2.5.19 - Subscriber+ Stored XSS (CVSS 5.4, Html5 Video Player)
- [CVE-2023-6271](https://cve.now/CVE-2023-6271.md): Backup Migration Staging \< 1.3.6 - Sensitive Data Exposure (CVSS 7.5, Backup Migration)
- [CVE-2023-6421](https://cve.now/CVE-2023-6421.md): Download Manager \< 3.2.83 - Unauthenticated Protected File Download Password Leak (CVSS 7.5, Download Manager)
- [CVE-2023-6064](https://cve.now/CVE-2023-6064.md): PayHere Payment Gateway \< 2.2.12 - Unauthenticated Log Data Disclosure (CVSS 7.5, PayHere Payment Gateway)
- [CVE-2023-50094](https://cve.now/CVE-2023-50094.md): reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. (CVSS 8.8)
- [CVE-2023-50096](https://cve.now/CVE-2023-50096.md): STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to t (CVSS 7.5)
- [CVE-2024-21732](https://cve.now/CVE-2024-21732.md): FlyCms through abbaa5a allows XSS via the permission management feature. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.