# CVEs published 2024-01-13

52 CVEs were published on January 13, 2024: 1 critical, 13 high. Days are UTC.

- [CVE-2024-0510](https://cve.now/CVE-2024-0510.md): HaoKeKeJi YiQiNiu Api.php http\_post server-side request forgery (CVSS 7.3, HaoKeKeJi YiQiNiu)
- [CVE-2024-0505](https://cve.now/CVE-2024-0505.md): ZhongFuCheng3y Austin Upload Material Menu MaterialController.java getFile unrestricted upload (CVSS 5.5, ZhongFuCheng3y Austin)
- [CVE-2024-0504](https://cve.now/CVE-2024-0504.md): code-projects Simple Online Hotel Reservation System Make a Reservation Page add\_reserve.php cross site scripting (CVSS 3.5, code-projects Simple Online Hotel Reservation System)
- [CVE-2024-0503](https://cve.now/CVE-2024-0503.md): code-projects Online FIR System registercomplaint.php cross site scripting (CVSS 3.5, code-projects Online FIR System)
- [CVE-2024-0502](https://cve.now/CVE-2024-0502.md): SourceCodester House Rental Management System Edit User manage\_user.php sql injection (CVSS 4.7, SourceCodester House Rental Management System)
- [CVE-2024-0501](https://cve.now/CVE-2024-0501.md): SourceCodester House Rental Management System Manage Invoice Details cross site scripting (CVSS 2.4, SourceCodester House Rental Management System)
- [CVE-2024-0500](https://cve.now/CVE-2024-0500.md): SourceCodester House Rental Management System Manage Tenant Details cross site scripting (CVSS 2.4, SourceCodester House Rental Management System)
- [CVE-2024-0499](https://cve.now/CVE-2024-0499.md): SourceCodester House Rental Management System index.php cross site scripting (CVSS 2.4, SourceCodester House Rental Management System)
- [CVE-2024-0498](https://cve.now/CVE-2024-0498.md): Project Worlds Lawyer Management System searchLawyer.php sql injection (CVSS 6.3, Project Worlds Lawyer Management System)
- [CVE-2024-0497](https://cve.now/CVE-2024-0497.md): Campcodes Student Information System sql injection (CVSS 6.3, Campcodes Student Information System)
- [CVE-2024-0496](https://cve.now/CVE-2024-0496.md): Kashipara Billing Software HTTP POST Request item\_list\_edit.php sql injection (CVSS 6.3, Kashipara Billing Software)
- [CVE-2024-0495](https://cve.now/CVE-2024-0495.md): Kashipara Billing Software HTTP POST Request party\_submit.php sql injection (CVSS 6.3, Kashipara Billing Software)
- [CVE-2024-0494](https://cve.now/CVE-2024-0494.md): Kashipara Billing Software HTTP POST Request material\_bill.php sql injection (CVSS 6.3, Kashipara Billing Software)
- [CVE-2024-0493](https://cve.now/CVE-2024-0493.md): Kashipara Billing Software HTTP POST Request submit\_delivery\_list.php sql injection (CVSS 6.3, Kashipara Billing Software)
- [CVE-2024-0492](https://cve.now/CVE-2024-0492.md): Kashipara Billing Software HTTP POST Request buyer\_detail\_submit.php sql injection (CVSS 6.3, Kashipara Billing Software)
- [CVE-2024-0491](https://cve.now/CVE-2024-0491.md): Huaxia ERP UserController.java password recovery (CVSS 5.3, Huaxia ERP)
- [CVE-2024-0490](https://cve.now/CVE-2024-0490.md): Huaxia ERP getAllList information disclosure (CVSS 5.3, Huaxia ERP)
- [CVE-2024-0489](https://cve.now/CVE-2024-0489.md): code-projects Fighting Cock Information System edit\_chicken.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0488](https://cve.now/CVE-2024-0488.md): code-projects Fighting Cock Information System new-feed.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0487](https://cve.now/CVE-2024-0487.md): code-projects Fighting Cock Information System delete-vaccine.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0486](https://cve.now/CVE-2024-0486.md): code-projects Fighting Cock Information System add\_con.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0485](https://cve.now/CVE-2024-0485.md): code-projects Fighting Cock Information System add\_con.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0484](https://cve.now/CVE-2024-0484.md): code-projects Fighting Cock Information System update\_mother.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0483](https://cve.now/CVE-2024-0483.md): Taokeyun HTTP POST Request Task.php index sql injection (CVSS 6.3, Taokeyun)
- [CVE-2024-0482](https://cve.now/CVE-2024-0482.md): Taokeyun HTTP POST Request Video.php index sql injection (CVSS 6.3, Taokeyun)
- [CVE-2024-0481](https://cve.now/CVE-2024-0481.md): Taokeyun HTTP POST Request Goods.php shopGoods sql injection (CVSS 6.3, Taokeyun)
- [CVE-2024-22209](https://cve.now/CVE-2024-22209.md): XBlock custom auth does not respect JWT Scopes (CVSS 6.4, openedx edx-platform)
- [CVE-2024-21640](https://cve.now/CVE-2024-21640.md): OOB Access in CefVideoConsumerOSR::OnFrameCaptured (CVSS 5.4, chromiumembedded cef)
- [CVE-2024-0251](https://cve.now/CVE-2024-0251.md): Advanced Woo Search \<= 2.96 - Reflected Cross-Site Scripting (CVSS 6.1, mihail-barinov Advanced Woo Search – Product Search for Woo…)
- [CVE-2024-0480](https://cve.now/CVE-2024-0480.md): Taokeyun HTTP POST Request Drs.php index sql injection (CVSS 7.3, Taokeyun)
- [CVE-2024-0479](https://cve.now/CVE-2024-0479.md): Taokeyun HTTP POST Request User.php login sql injection (CVSS 7.3, Taokeyun)
- [CVE-2024-0478](https://cve.now/CVE-2024-0478.md): code-projects Fighting Cock Information System edit\_chicken.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0477](https://cve.now/CVE-2024-0477.md): code-projects Fighting Cock Information System update-deworm.php sql injection (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2024-0476](https://cve.now/CVE-2024-0476.md): Blood Bank & Donor Management request-received-bydonar.php cross site scripting (CVSS 2.4, Blood Bank & Donor Management)
- [CVE-2024-0475](https://cve.now/CVE-2024-0475.md): code-projects Dormitory Management System modifyuser.php sql injection (CVSS 6.3, code-projects Dormitory Management System)
- [CVE-2023-33472](https://cve.now/CVE-2023-33472.md): An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate (CVSS 8.8)
- [CVE-2023-46942](https://cve.now/CVE-2023-46942.md): Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive informatio (CVSS 7.5, @evershop/evershop)
- [CVE-2023-46943](https://cve.now/CVE-2023-46943.md): An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. (CVSS 9.1, @evershop/evershop)
- [CVE-2023-50072](https://cve.now/CVE-2023-50072.md): A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authe (CVSS 5.4)
- [CVE-2023-51062](https://cve.now/CVE-2023-51062.md): An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE\_3-0 Build 7 Patch 0 allows attackers to (CVSS 5.3)
- [CVE-2023-51063](https://cve.now/CVE-2023-51063.md): QStar Archive Solutions Release RELEASE\_3-0 Build 7 Patch 0 was discovered to contain a DOM Based Reflected Cross Site Scripting (XSS) vulne (CVSS 8.8)
- [CVE-2023-51064](https://cve.now/CVE-2023-51064.md): QStar Archive Solutions Release RELEASE\_3-0 Build 7 Patch 0 was discovered to contain a DOM Based reflected XSS vulnerability within the com (CVSS 6.1)
- [CVE-2023-51065](https://cve.now/CVE-2023-51065.md): Incorrect access control in QStar Archive Solutions Release RELEASE\_3-0 Build 7 Patch 0 allows unauthenticated attackers to obtain system ba (CVSS 7.5)
- [CVE-2023-51066](https://cve.now/CVE-2023-51066.md): An authenticated remote code execution vulnerability in QStar Archive Solutions Release RELEASE\_3-0 Build 7 Patch 0 allows attackers to arbi (CVSS 8.8)
- [CVE-2023-51067](https://cve.now/CVE-2023-51067.md): An unauthenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE\_3-0 Build 7 allows attacker (CVSS 6.1)
- [CVE-2023-51068](https://cve.now/CVE-2023-51068.md): An authenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE\_3-0 Build 7 allows attackers (CVSS 5.4)
- [CVE-2023-51070](https://cve.now/CVE-2023-51070.md): An access control issue in QStar Archive Solutions Release RELEASE\_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily adjus (CVSS 7.5)
- [CVE-2023-51071](https://cve.now/CVE-2023-51071.md): An access control issue in QStar Archive Solutions Release RELEASE\_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily disab (CVSS 6.5)
- [CVE-2023-51804](https://cve.now/CVE-2023-51804.md): An issue in rymcu forest v.0.02 allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.ry (CVSS 7.5)
- [CVE-2023-51805](https://cve.now/CVE-2023-51805.md): SQL Injection vulnerability in TDuckCLoud tduck-platform v.4.0 allows a remote attacker to obtain sensitive information via the getFormKey p (CVSS 8.1)
- [CVE-2023-52288](https://cve.now/CVE-2023-52288.md): An issue was discovered in the flaskcode package through 0.0.8 for Python. (CVSS 7.5, flaskcode)
- [CVE-2023-52289](https://cve.now/CVE-2023-52289.md): An issue was discovered in the flaskcode package through 0.0.8 for Python. (CVSS 7.5, flaskcode)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.