# CVEs published 2024-01-16

227 CVEs were published on January 16, 2024: 12 critical, 84 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-22406](https://cve.now/CVE-2024-22406.md): Blind SQL-injection in DAL aggregations in Shopware (CVSS 9.3, shopware · shopware/core +1)
- [CVE-2024-22407](https://cve.now/CVE-2024-22407.md): Broken Access Control order API in Shopware (CVSS 4.9, shopware · shopware/core +1)
- [CVE-2024-22408](https://cve.now/CVE-2024-22408.md): Server-Side Request Forgery (SSRF) in Shopware Flow Builder (CVSS 7.6, shopware)
- [CVE-2024-22409](https://cve.now/CVE-2024-22409.md): Default Privileges allow for high level operations for low privileged users in datahub (CVSS 7.5, datahub-project datahub)
- [CVE-2024-0603](https://cve.now/CVE-2024-0603.md): ZhiCms giftcontroller.php deserialization (CVSS 7.3, ZhiCms)
- [CVE-2024-22411](https://cve.now/CVE-2024-22411.md): Cross site scripting in Action messages on Avo (CVSS 6.5, avo-hq avo · avo)
- [CVE-2024-22191](https://cve.now/CVE-2024-22191.md): Stored cross-site scripting (XSS) in \`key\_value\` field in Avo (CVSS 7.3, avo-hq avo · avo)
- [CVE-2024-22192](https://cve.now/CVE-2024-22192.md): Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders (CVSS 6.5, hyperledger-archives ursa · ursa +1)
- [CVE-2024-21670](https://cve.now/CVE-2024-21670.md): CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential (CVSS 6.5, hyperledger-archives ursa · ursa +1)
- [CVE-2024-20987](https://cve.now/CVE-2024-20987.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 5.4, Oracle BI Publisher)
- [CVE-2024-20985](https://cve.now/CVE-2024-20985.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20983](https://cve.now/CVE-2024-20983.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20981](https://cve.now/CVE-2024-20981.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20979](https://cve.now/CVE-2024-20979.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 5.4, Oracle BI Publisher)
- [CVE-2024-20977](https://cve.now/CVE-2024-20977.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20975](https://cve.now/CVE-2024-20975.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20973](https://cve.now/CVE-2024-20973.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20971](https://cve.now/CVE-2024-20971.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20969](https://cve.now/CVE-2024-20969.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2024-20967](https://cve.now/CVE-2024-20967.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2024-20965](https://cve.now/CVE-2024-20965.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL NDB Cluster · Oracle MySQL Server)
- [CVE-2024-20963](https://cve.now/CVE-2024-20963.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20961](https://cve.now/CVE-2024-20961.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20959](https://cve.now/CVE-2024-20959.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). (CVSS 4.4, Oracle Sun ZFS Storage Appliance Kit (AK) Software)
- [CVE-2024-20957](https://cve.now/CVE-2024-20957.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). (CVSS 2.7, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2024-20955](https://cve.now/CVE-2024-20955.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). (CVSS 3.7, Oracle GraalVM Enterprise Edition)
- [CVE-2024-20952](https://cve.now/CVE-2024-20952.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Securit (CVSS 7.4, Oracle Java SE JDK and JRE)
- [CVE-2024-20950](https://cve.now/CVE-2024-20950.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). (CVSS 6.1, Oracle Customer Interaction History)
- [CVE-2024-20948](https://cve.now/CVE-2024-20948.md): Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). (CVSS 6.1, Oracle Knowledge Management)
- [CVE-2024-20946](https://cve.now/CVE-2024-20946.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 5.5, Oracle Solaris Operating System)
- [CVE-2024-20944](https://cve.now/CVE-2024-20944.md): Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). (CVSS 5.4, Oracle iSupport)
- [CVE-2024-20942](https://cve.now/CVE-2024-20942.md): Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain (component: LOV). (CVSS 6.1, Oracle Complex Maintenance, Repair, and Overhaul)
- [CVE-2024-20940](https://cve.now/CVE-2024-20940.md): Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Create, Update, Authoring Flow). (CVSS 6.1, Oracle Knowledge Management)
- [CVE-2024-20938](https://cve.now/CVE-2024-20938.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: ECC). (CVSS 6.1, Oracle iStore)
- [CVE-2024-20936](https://cve.now/CVE-2024-20936.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 6.1, Oracle One-to-One Fulfillment)
- [CVE-2024-20934](https://cve.now/CVE-2024-20934.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). (CVSS 6.1, Oracle Installed Base)
- [CVE-2024-20932](https://cve.now/CVE-2024-20932.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Securit (CVSS 7.5, Oracle Java SE JDK and JRE)
- [CVE-2024-20930](https://cve.now/CVE-2024-20930.md): Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF (CVSS 6.3, Oracle Outside In Technology)
- [CVE-2024-20928](https://cve.now/CVE-2024-20928.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 6.1, Oracle WebCenter Content)
- [CVE-2024-20926](https://cve.now/CVE-2024-20926.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripti (CVSS 5.9, Oracle Java SE JDK and JRE)
- [CVE-2024-20924](https://cve.now/CVE-2024-20924.md): Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). (CVSS 7.6, Oracle Audit Vault and Database Firewall)
- [CVE-2024-20922](https://cve.now/CVE-2024-20922.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). (CVSS 2.5, Oracle Java SE JDK and JRE)
- [CVE-2024-20920](https://cve.now/CVE-2024-20920.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 3.8, Oracle Solaris Operating System)
- [CVE-2024-20918](https://cve.now/CVE-2024-20918.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 7.4, Oracle Java SE JDK and JRE)
- [CVE-2024-20916](https://cve.now/CVE-2024-20916.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). (CVSS 8.3, Oracle Enterprise Manager Base Platform)
- [CVE-2024-20914](https://cve.now/CVE-2024-20914.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). (CVSS 2.3, Oracle Sun ZFS Storage Appliance Kit (AK) Software)
- [CVE-2024-20912](https://cve.now/CVE-2024-20912.md): Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). (CVSS 2.7, Oracle Audit Vault and Database Firewall)
- [CVE-2024-20910](https://cve.now/CVE-2024-20910.md): Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). (CVSS 3.0, Oracle Audit Vault and Database Firewall)
- [CVE-2024-20908](https://cve.now/CVE-2024-20908.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). (CVSS 6.1, Oracle WebCenter Sites)
- [CVE-2024-20906](https://cve.now/CVE-2024-20906.md): Vulnerability in the Integrated Lights Out Manager (ILOM) product of Oracle Systems (component: System Management). (CVSS 4.8, Oracle SSM - (hot-tamale) ILOM: Integrated Lights Out Manag…)
- [CVE-2024-20904](https://cve.now/CVE-2024-20904.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). (CVSS 5.0, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-21901](https://cve.now/CVE-2023-21901.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 7.4, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2022-31021](https://cve.now/CVE-2022-31021.md): Unlinkability broken in ursa when verifiers use malicious keys (CVSS 3.3, hyperledger ursa · anoncreds-clsignatures +1)
- [CVE-2024-0601](https://cve.now/CVE-2024-0601.md): ZhongFuCheng3y Austin Email Message Template AustinFileUtils.java getRemoteUrl2File server-side request forgery (CVSS 6.3, ZhongFuCheng3y Austin)
- [CVE-2024-0519](https://cve.now/CVE-2024-0519.md): Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, KEV, Google Chrome)
- [CVE-2024-0518](https://cve.now/CVE-2024-0518.md): Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 7.5, Google Chrome)
- [CVE-2024-0517](https://cve.now/CVE-2024-0517.md): Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2024-0599](https://cve.now/CVE-2024-0599.md): Jspxcms Document Management Page InfoController.java cross site scripting (CVSS 3.5, Jspxcms)
- [CVE-2023-6336](https://cve.now/CVE-2023-6336.md): Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows User-Controlled Filena (CVSS 7.2, HYPR Workforce Access)
- [CVE-2023-6335](https://cve.now/CVE-2023-6335.md): Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on Windows allows User-Controlled File (CVSS 6.4, HYPR Workforce Access)
- [CVE-2023-6334](https://cve.now/CVE-2023-6334.md): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in HYPR Workforce Access on Windows allows Overflow Bu (CVSS 5.3, HYPR Workforce Access)
- [CVE-2023-5097](https://cve.now/CVE-2023-5097.md): Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: befor (CVSS 7.0, HYPR Workforce Access)
- [CVE-2024-0507](https://cve.now/CVE-2024-0507.md): Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server (CVSS 6.5, GitHub Enterprise Server)
- [CVE-2024-0200](https://cve.now/CVE-2024-0200.md): Unsafe Reflection in Github Enterprise Server leading to Command Injection (CVSS 7.2, GitHub Enterprise Server)
- [CVE-2023-7234](https://cve.now/CVE-2023-7234.md): Integration Objects OPC UA Server Toolkit Improper Output Neutralization for Logs (CVSS 5.3, Integration Objects OPC UA Server Toolkit)
- [CVE-2024-23347](https://cve.now/CVE-2024-23347.md): Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of (CVSS 7.8, Meta Platforms Meta Spark Studio)
- [CVE-2023-37523](https://cve.now/CVE-2023-37523.md): HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags (CVSS 5.6, HCL Software HCL BigFix OSD Bare Metal Server WebUI)
- [CVE-2023-4969](https://cve.now/CVE-2023-4969.md): GPU kernel implementations susceptible to memory leak (CVSS 6.5, Khronos Group OpenCL · Khronos Group Vulkan)
- [CVE-2024-0579](https://cve.now/CVE-2024-0579.md): Totolink X2000R formMapDelDevice command injection (CVSS 5.3, Totolink X2000R)
- [CVE-2023-45234](https://cve.now/CVE-2023-45234.md): Buffer Overflow in EDK II Network Package (CVSS 8.3, TianoCore edk2)
- [CVE-2023-45233](https://cve.now/CVE-2023-45233.md): Infinite loop in EDK II Network Package (CVSS 7.5, TianoCore edk2)
- [CVE-2023-45232](https://cve.now/CVE-2023-45232.md): Infinite loop in EDK II Network Package (CVSS 7.5, TianoCore edk2)
- [CVE-2023-45235](https://cve.now/CVE-2023-45235.md): Buffer Overflow in EDK II Network Package (CVSS 8.3, TianoCore edk2)
- [CVE-2023-45237](https://cve.now/CVE-2023-45237.md): Use of a Weak PseudoRandom Number Generator in EDK II Network Package (CVSS 5.3, TianoCore edk2)
- [CVE-2023-45236](https://cve.now/CVE-2023-45236.md): Predictable TCP ISNs in EDK II Network Package (CVSS 5.8, TianoCore edk2)
- [CVE-2023-45231](https://cve.now/CVE-2023-45231.md): Out-of-Bounds Read in EDK II Network Package (CVSS 6.5, TianoCore edk2)
- [CVE-2023-45230](https://cve.now/CVE-2023-45230.md): Buffer Overflow in EDK II Network Package (CVSS 8.3, TianoCore edk2)
- [CVE-2023-45229](https://cve.now/CVE-2023-45229.md): Out-of-Bounds Read in EDK II Network Package (CVSS 6.5, TianoCore edk2)
- [CVE-2024-0578](https://cve.now/CVE-2024-0578.md): Totolink LR1200GB cstecgi.cgi UploadCustomModule stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2023-37522](https://cve.now/CVE-2023-37522.md): HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags (CVSS 5.6, HCL Software HCL BigFix OSD Bare Metal Server WebUI)
- [CVE-2023-7151](https://cve.now/CVE-2023-7151.md): Product Enquiry for WooCommerce \< 3.2 - Reflected XSS (CVSS 6.1, Product Enquiry for WooCommerce)
- [CVE-2023-6373](https://cve.now/CVE-2023-6373.md): ArtPlacer Widget \< 2.20.7 - Editor+ SQLi (CVSS 8.8, ArtPlacer Widget)
- [CVE-2023-6292](https://cve.now/CVE-2023-6292.md): Ecwid Ecommerce Shopping Cart \< 6.12.5 - Arbitrary Plugin Settings Change via CSRF (CVSS 4.3, Ecwid Ecommerce Shopping Cart)
- [CVE-2023-5922](https://cve.now/CVE-2023-5922.md): Royal Elementor Addons and Templates \< 1.3.81 - Unauthenticated Arbitrary Post Read (CVSS 7.5, Royal Elementor Addons and Templates)
- [CVE-2024-0238](https://cve.now/CVE-2024-0238.md): EventON (Free \< 2.2.8, Premium \< 4.5.6) - Unauthenticated Arbitrary Post Metadata Update (CVSS 6.1, EventON Premium · EventON)
- [CVE-2023-7125](https://cve.now/CVE-2023-7125.md): Community by PeepSo \< 6.3.1.2 - User Post Creation via CSRF (CVSS 4.3, Community by PeepSo)
- [CVE-2024-0235](https://cve.now/CVE-2024-0235.md): EventON (Free \< 2.2.8, Premium \< 4.5.5) - Unauthenticated Email Address Disclosure (CVSS 5.3, EventON)
- [CVE-2023-7083](https://cve.now/CVE-2023-7083.md): Voting Record \<= 2.0 - Settings Update to Stored XSS via CSRF (CVSS 5.4, Voting Record)
- [CVE-2024-0239](https://cve.now/CVE-2024-0239.md): Contact Form 7 Connector \< 1.2.3 - Reflected XSS (CVSS 6.1, Contact Form 7 Connector)
- [CVE-2023-7084](https://cve.now/CVE-2023-7084.md): Voting Record \<= 2.0 - Subscriber+ Stored XSS (CVSS 5.4, Voting Record)
- [CVE-2023-7154](https://cve.now/CVE-2023-7154.md): Hubbub Lite \< 1.32.0 - Admin+ Stored XSS (CVSS 4.8, Hubbub Lite)
- [CVE-2023-6732](https://cve.now/CVE-2023-6732.md): Ultimate Maps by Supsystic \< 1.2.16 - Admin+ Stored XSS (CVSS 4.8, Ultimate Maps by Supsystic)
- [CVE-2024-0233](https://cve.now/CVE-2024-0233.md): EventON (Free \< 2.2.8, Premium \< 4.5.5) - Reflected XSS (CVSS 6.1, EventON)
- [CVE-2023-6005](https://cve.now/CVE-2023-6005.md): EventON (Free \< 2.2.7, Premium \< 4.5.5) - Admin+ Stored Cross-Site Scripting (CVSS 4.8, EventON)
- [CVE-2023-6592](https://cve.now/CVE-2023-6592.md): FastDup – Fastest WordPress Migration & Duplicator \< 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure (CVSS 5.3, FastDup)
- [CVE-2024-0187](https://cve.now/CVE-2024-0187.md): Community by PeepSo \< 6.3.1.2 - Reflected XSS (CVSS 6.1, Community by PeepSo)
- [CVE-2023-6824](https://cve.now/CVE-2023-6824.md): WP Customer Area \< 8.2.1 - Subscriber+ Account Address Leak (CVSS 6.5, WP Customer Area)
- [CVE-2024-0236](https://cve.now/CVE-2024-0236.md): EventON (Free \< 2.2.8, Premium \< 4.5.5) - Unauthenticated Virtual Event Password Disclosure (CVSS 5.3, EventON)
- [CVE-2024-0237](https://cve.now/CVE-2024-0237.md): EventON (Free \< 2.2.9, Premium \<= 4.5.8) - Unauthenticated Virtual Event Settings Update (CVSS 5.3, EventON Premium · EventON)
- [CVE-2023-6741](https://cve.now/CVE-2023-6741.md): WP Customer Area \< 8.2.1 - Subscriber+ Account Address Update (CVSS 4.3, WP Customer Area)
- [CVE-2023-4703](https://cve.now/CVE-2023-4703.md): All in One B2B for WooCommerce \<= 1.0.3 - Unauthenticated Privilege Escalation (CVSS 7.5, All in One B2B for WooCommerce)
- [CVE-2023-4797](https://cve.now/CVE-2023-4797.md): Newsletter Lite \< 4.9.3 - Admin+ Command Injection (CVSS 7.2, Newsletters)
- [CVE-2023-4757](https://cve.now/CVE-2023-4757.md): Staff / Employee Business Directory for Active Directory \< 1.2.3 - Improper escaping of LDAP entries (CVSS 5.4, Staff / Employee Business Directory for Active Directory)
- [CVE-2023-4536](https://cve.now/CVE-2023-4536.md): My Account Page Editor \< 1.3.2 - Subscriber+ Arbitrary File Upload (CVSS 8.8, My Account Page Editor)
- [CVE-2023-0824](https://cve.now/CVE-2023-0824.md): UserPlus \<= 2.0 - Stored XSS via CSRF (CVSS 7.4, User registration & user profile)
- [CVE-2023-0769](https://cve.now/CVE-2023-0769.md): hiWeb Migration Simple \<= 2.0.0.1 Reflected Cross-Site Scripting (CVSS 6.1, hiWeb Migration Simple)
- [CVE-2023-1405](https://cve.now/CVE-2023-1405.md): Formidable Forms \< 6.2 - Unauthenticated PHP Object Injection (CVSS 7.5, Formidable Forms)
- [CVE-2023-0389](https://cve.now/CVE-2023-0389.md): Calculated Fields Form \< 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields (CVSS 4.8, Calculated Fields Form)
- [CVE-2023-0376](https://cve.now/CVE-2023-0376.md): Qubely \< 1.8.5 - Contributor+ Stored XSS (CVSS 5.4, Qubely)
- [CVE-2023-0094](https://cve.now/CVE-2023-0094.md): UpQode Google Maps \<= 1.0.5 - Contributor+ Stored XSS (CVSS 5.4, UpQode Google Maps)
- [CVE-2023-2252](https://cve.now/CVE-2023-2252.md): Directorist \< 7.5.4 - Admin+ LFI (CVSS 2.7, Directorist)
- [CVE-2023-3372](https://cve.now/CVE-2023-3372.md): Lana Shortcodes \< 1.2.0 - Contributor+ Stored XSS (CVSS 5.4, Lana Shortcodes)
- [CVE-2023-3178](https://cve.now/CVE-2023-3178.md): POST SMTP Mailer \< 2.5.7 - Arbitrary Log Deletion via CSRF (CVSS 4.3, POST SMTP Mailer)
- [CVE-2023-37521](https://cve.now/CVE-2023-37521.md): HCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosure (CVSS 2.3, HCL Software HCL BigFix OSD Bare Metal Server WebUI)
- [CVE-2023-2655](https://cve.now/CVE-2023-2655.md): Contact Form by WD \<= 1.13.23 - Admin+ SQLi (CVSS 7.2, Contact Form by WD)
- [CVE-2023-0479](https://cve.now/CVE-2023-0479.md): Print Invoice & Delivery Notes for WooCommerce \< 4.7.2 - Reflected XSS (CVSS 6.1, Print Invoice & Delivery Notes for WooCommerce)
- [CVE-2023-0079](https://cve.now/CVE-2023-0079.md): Customer Reviews for WooCommerce \< 5.17.0 - Contributor+ Stored XSS (CVSS 5.4, Customer Reviews for WooCommerce)
- [CVE-2023-0224](https://cve.now/CVE-2023-0224.md): GiveWP \< 2.24.1 - Unauthenticated SQLi (CVSS 9.8, GiveWP)
- [CVE-2023-5558](https://cve.now/CVE-2023-5558.md): LearnPress \< 4.2.5.5 - Reflected Cross-Site Scripting (CVSS 6.1, LearnPress)
- [CVE-2023-6046](https://cve.now/CVE-2023-6046.md): EventON \< 2.2 - Admin+ Stored HTML Injection (CVSS 4.8, EventON)
- [CVE-2023-3771](https://cve.now/CVE-2023-3771.md): T1 theme \<= 19.0 - Open Redirect (CVSS 6.1, t1)
- [CVE-2023-3211](https://cve.now/CVE-2023-3211.md): WordPress Database Administrator \<= 1.0.3 - Unauthenticated SQL Injection (CVSS 9.8, WordPress Database Administrator)
- [CVE-2023-3647](https://cve.now/CVE-2023-3647.md): IURNY by INDIGITALL \< 3.2.3 - Admin+ Stored XSS (CVSS 4.8, IURNY by INDIGITALL)
- [CVE-2022-3194](https://cve.now/CVE-2022-3194.md): Dokan \< 3.6.4 - Vendor Stored Cross-Site Scripting (CVSS 5.4, Dokan)
- [CVE-2022-3829](https://cve.now/CVE-2022-3829.md): Font Awesome 4 Menus \<= 4.7.0 - Admin+ Stored XSS (CVSS 4.8, Font Awesome 4 Menus)
- [CVE-2022-3739](https://cve.now/CVE-2022-3739.md): WP Best Quiz \<= 1.0 - Author+ Stored XSS (CVSS 5.4, WP Best Quiz)
- [CVE-2022-3604](https://cve.now/CVE-2022-3604.md): Contact Form Entries \< 1.3.0 - CSV Injection (CVSS 7.8, Contact Form Entries)
- [CVE-2022-1618](https://cve.now/CVE-2022-1618.md): Coru LFMember \<= 1.0.2 - Stored Cross-Site Scripting via CSRF (CVSS 6.1, Coru LFMember)
- [CVE-2022-1617](https://cve.now/CVE-2022-1617.md): WP-Invoice \<= 4.3.1 - Stored Cross-Site Scripting via CSRF (CVSS 6.1, WP-Invoice)
- [CVE-2022-0775](https://cve.now/CVE-2022-0775.md): WooCommerce \< 6.2.1 - Subscriber+ Arbitrary Comment Deletion (CVSS 4.3, WooCommerce)
- [CVE-2021-4227](https://cve.now/CVE-2021-4227.md): Ark Comment Editor \<= 2.15.6 - Iframe Injection via Comment (CVSS 5.3, ark-commenteditor)
- [CVE-2022-1609](https://cve.now/CVE-2022-1609.md): The School Management \< 9.9.7 - Unauthenticated RCE via REST api (CVSS 9.8, school-management-pro)
- [CVE-2022-1760](https://cve.now/CVE-2022-1760.md): Core Control \<= 1.2.1 - Arbitrary Settings Update via CSRF (CVSS 4.3, Core Control)
- [CVE-2022-23179](https://cve.now/CVE-2022-23179.md): Contact Form & Lead Form Elementor Builder \< 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting (CVSS 4.8, Contact Form & Lead Form Elementor Builder)
- [CVE-2022-23180](https://cve.now/CVE-2022-23180.md): Contact Form & Lead Form Elementor Builder Plugin \< 1.7.4 - Multiple Subscriber+ Settings Update (CVSS 4.3, Contact Form & Lead Form Elementor Builder)
- [CVE-2022-0402](https://cve.now/CVE-2022-0402.md): Superforms \< 6.0.4 - Reflected Cross-Site Scripting (CVSS 6.1, Super Forms - Drag & Drop Form Builder)
- [CVE-2022-3899](https://cve.now/CVE-2022-3899.md): 3DPrint \< 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF (CVSS 8.1, 3dprint)
- [CVE-2022-3764](https://cve.now/CVE-2022-3764.md): Form Vibes \< 1.4.5 - Admin+ SQLi (CVSS 7.2, Form Vibes)
- [CVE-2022-3836](https://cve.now/CVE-2022-3836.md): Seed Social \< 2.0.4 - Admin+ Stored XSS (CVSS 4.8, Seed Social)
- [CVE-2022-1538](https://cve.now/CVE-2022-1538.md): Theme-Demo-Importer \< 1.1.1 - Admin+ Arbitrary File Upload (CVSS 7.2, Theme Demo Import)
- [CVE-2022-1563](https://cve.now/CVE-2022-1563.md): WPGraphQL WooCommerce \<= 0.11.0 - Unauthenticated Coupon Codes Disclosure (CVSS 5.3, wp-graphql-woocommerce)
- [CVE-2022-2413](https://cve.now/CVE-2022-2413.md): Slide Anything \< 2.3.47 - Author+ Cross Site Scripting in slide title (CVSS 5.4, Slide Anything)
- [CVE-2021-24870](https://cve.now/CVE-2021-24870.md): WP Fastest Cache \< 0.9.5 - CSRF to Stored Cross-Site Scripting (CVSS 6.1, WP Fastest Cache)
- [CVE-2021-24869](https://cve.now/CVE-2021-24869.md): WP Fastest Cache \< 0.9.5 - Subscriber+ SQL Injection (CVSS 8.8, WP Fastest Cache)
- [CVE-2021-24433](https://cve.now/CVE-2021-24433.md): Simple Sort&Search \<= 0.0.3 - Ccontributor+ Stored XSS (CVSS 5.4, simple sort&search)
- [CVE-2021-24432](https://cve.now/CVE-2021-24432.md): Advanced AJAX Product Filters \< 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS) (CVSS 6.1, Advanced AJAX Product Filters)
- [CVE-2021-25117](https://cve.now/CVE-2021-25117.md): WP Postratings \< 1.86.1 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, WP-PostRatings)
- [CVE-2021-24151](https://cve.now/CVE-2021-24151.md): WP Editor \< 1.2.7 - Authenticated SQL injection (CVSS 7.2, WP Editor)
- [CVE-2021-24559](https://cve.now/CVE-2021-24559.md): Qyrr \< 0.7 - Authenticated (contributor+) Stored XSS (CVSS 5.4, Qyrr)
- [CVE-2021-24566](https://cve.now/CVE-2021-24566.md): WooCommerce Currency Switcher \< 1.3.7 - Authenticated (Low Privilege) Local File Inclusion (CVSS 8.8, FOX)
- [CVE-2021-24567](https://cve.now/CVE-2021-24567.md): Simple Post \<= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) (CVSS 5.4, Simple Post)
- [CVE-2024-0577](https://cve.now/CVE-2024-0577.md): Totolink LR1200GB cstecgi.cgi setLanguageCfg stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2024-0576](https://cve.now/CVE-2024-0576.md): Totolink LR1200GB cstecgi.cgi setIpPortFilterRules stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2024-0575](https://cve.now/CVE-2024-0575.md): Totolink LR1200GB cstecgi.cgi setTracerouteCfg stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2024-0574](https://cve.now/CVE-2024-0574.md): Totolink LR1200GB cstecgi.cgi setParentalRules stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2024-0582](https://cve.now/CVE-2024-0582.md): Kernel: io\_uring: page use-after-free vulnerability via buffer ring mmap (CVSS 7.8, kernel · Red Hat Enterprise Linux)
- [CVE-2023-6395](https://cve.now/CVE-2023-6395.md): Mock: privilege escalation for users that can access mock configuration (CVSS 6.7, mock · Red Hat Enterprise Linux +3)
- [CVE-2024-0573](https://cve.now/CVE-2024-0573.md): Totolink LR1200GB cstecgi.cgi setDiagnosisCfg stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2021-4432](https://cve.now/CVE-2021-4432.md): PCMan FTP Server USER Command denial of service (CVSS 5.3, PCMan FTP Server)
- [CVE-2024-0567](https://cve.now/CVE-2024-0567.md): Gnutls: rejects certificate chain with distributed trust (CVSS 7.5, gnutls · Red Hat Enterprise Linux +3)
- [CVE-2024-0232](https://cve.now/CVE-2024-0232.md): Sqlite: use-after-free bug in jsonparseaddnodearray (CVSS 4.7, sqlite · Red Hat Enterprise Linux)
- [CVE-2024-0572](https://cve.now/CVE-2024-0572.md): Totolink LR1200GB cstecgi.cgi setOpModeCfg stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2024-0571](https://cve.now/CVE-2024-0571.md): Totolink LR1200GB cstecgi.cgi setSmsCfg stack-based overflow (CVSS 8.8, Totolink LR1200GB)
- [CVE-2024-0570](https://cve.now/CVE-2024-0570.md): Totolink N350RT Setting cstecgi.cgi access control (CVSS 6.9, Totolink N350RT)
- [CVE-2024-0581](https://cve.now/CVE-2024-0581.md): Uncontrolled Resource Consumption vulnerability on Sandsprite scdbg (CVSS 4.0, Sandsprite Scdbg)
- [CVE-2024-0569](https://cve.now/CVE-2024-0569.md): Totolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosure (CVSS 5.3, Totolink T8)
- [CVE-2024-0553](https://cve.now/CVE-2024-0553.md): Gnutls: incomplete fix for cve-2023-5981 (CVSS 7.5, gnutls · Red Hat Enterprise Linux +2)
- [CVE-2024-0556](https://cve.now/CVE-2024-0556.md): Weak Cryptography for Passwords vulnerability on WIC1200 (CVSS 7.1, Full Compass Systems WIC1200)
- [CVE-2024-0555](https://cve.now/CVE-2024-0555.md): Cross-Site Request Forgery (CSRF) vulnerability on WIC1200 (CVSS 4.6, Full Compass Systems WIC1200)
- [CVE-2024-0554](https://cve.now/CVE-2024-0554.md): Cross-site scripting (XSS) vulnerability on WIC1200 (CVSS 5.5, Full Compass Systems WIC1200)
- [CVE-2023-52106](https://cve.now/CVE-2023-52106.md): Vulnerability of permission verification for APIs in the DownloadProviderMain module. (CVSS 4.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52105](https://cve.now/CVE-2023-52105.md): The nearby module has a privilege escalation vulnerability. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2023-52104](https://cve.now/CVE-2023-52104.md): Vulnerability of parameters being not verified in the WMS module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52103](https://cve.now/CVE-2023-52103.md): Buffer overflow vulnerability in the FLP module. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52102](https://cve.now/CVE-2023-52102.md): Vulnerability of parameters being not verified in the WMS module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52101](https://cve.now/CVE-2023-52101.md): Component exposure vulnerability in the Wi-Fi module. (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52100](https://cve.now/CVE-2023-52100.md): The Celia Keyboard module has a vulnerability in access control. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2023-52099](https://cve.now/CVE-2023-52099.md): Vulnerability of foreground service restrictions being bypassed in the NMS module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34063](https://cve.now/CVE-2023-34063.md): Aria Automation contains a Missing Access Control vulnerability. (CVSS 9.9, VMware Aria Automation, VMware Cloud Foundation)
- [CVE-2023-52098](https://cve.now/CVE-2023-52098.md): Denial of Service (DoS) vulnerability in the DMS module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52108](https://cve.now/CVE-2023-52108.md): Vulnerability of process priorities being raised in the ActivityManagerService module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52107](https://cve.now/CVE-2023-52107.md): Vulnerability of permissions being not strictly verified in the WMS module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52116](https://cve.now/CVE-2023-52116.md): Permission management vulnerability in the multi-screen interaction module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52115](https://cve.now/CVE-2023-52115.md): The iaware module has a Use-After-Free (UAF) vulnerability. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2023-52114](https://cve.now/CVE-2023-52114.md): Data confidentiality vulnerability in the ScreenReader module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-44112](https://cve.now/CVE-2023-44112.md): Out-of-bounds access vulnerability in the device authentication module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2011-10005](https://cve.now/CVE-2011-10005.md): EasyFTP MKD Command buffer overflow (CVSS 6.3, EasyFTP)
- [CVE-2023-52113](https://cve.now/CVE-2023-52113.md): launchAnyWhere vulnerability in the ActivityManagerService module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52112](https://cve.now/CVE-2023-52112.md): Unauthorized file access vulnerability in the wallpaper service module. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52111](https://cve.now/CVE-2023-52111.md): Authorization vulnerability in the BootLoader module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52110](https://cve.now/CVE-2023-52110.md): The sensor module has an out-of-bounds access vulnerability.Successful exploitation of this vulnerability may affect availability. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2023-52109](https://cve.now/CVE-2023-52109.md): Vulnerability of trust relationships being inaccurate in distributed scenarios. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-44117](https://cve.now/CVE-2023-44117.md): Vulnerability of trust relationships being inaccurate in distributed scenarios. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-4566](https://cve.now/CVE-2023-4566.md): Vulnerability of trust relationships being inaccurate in distributed scenarios. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-21673](https://cve.now/CVE-2024-21673.md): This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. (CVSS 8.0, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2024-21672](https://cve.now/CVE-2024-21672.md): This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. (CVSS 8.3, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2023-22527](https://cve.now/CVE-2023-22527.md): A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE (CVSS 10.0, KEV, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2024-21674](https://cve.now/CVE-2024-21674.md): This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. (CVSS 8.6, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2023-22526](https://cve.now/CVE-2023-22526.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. (CVSS 7.2, Atlassian Confluence Data Center)
- [CVE-2024-22428](https://cve.now/CVE-2024-22428.md): Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. (CVSS 7.0, Dell iDRAC Service Module)
- [CVE-2024-22362](https://cve.now/CVE-2024-22362.md): Drupal contains a vulnerability with improper handling of structural elements. (CVSS 7.5, Drupal.org Drupal · drupal/core)
- [CVE-2023-6457](https://cve.now/CVE-2023-6457.md): File and Directory Permission Vulnerability in Hitachi Tuning Manager (CVSS 6.6, Hitachi Tuning Manager)
- [CVE-2023-49107](https://cve.now/CVE-2023-49107.md): Generation of Error Message Containing Sensitive Information Vulnerability in Hitachi Device Manager (CVSS 5.3, Hitachi Device Manager)
- [CVE-2023-49106](https://cve.now/CVE-2023-49106.md): Missing Password Field Masking Vulnerability in Hitachi Device Manager (CVSS 4.6, Hitachi Device Manager)
- [CVE-2023-36236](https://cve.now/CVE-2023-36236.md): Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file (CVSS 4.8, bagisto/bagisto)
- [CVE-2023-39691](https://cve.now/CVE-2023-39691.md): An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request. (CVSS 9.8)
- [CVE-2023-41619](https://cve.now/CVE-2023-41619.md): Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write. (CVSS 6.1)
- [CVE-2023-43449](https://cve.now/CVE-2023-43449.md): An issue in HummerRisk HummerRisk v.1.10 thru 1.4.1 allows an authenticated attacker to execute arbitrary code via a crafted request to the (CVSS 8.8)
- [CVE-2023-47459](https://cve.now/CVE-2023-47459.md): An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryReview/Service/CaseManagem (CVSS 6.5)
- [CVE-2023-47460](https://cve.now/CVE-2023-47460.md): SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Servi (CVSS 8.8)
- [CVE-2023-48104](https://cve.now/CVE-2023-48104.md): Alinto SOGo before 5.9.1 is vulnerable to HTML Injection. (CVSS 6.1)
- [CVE-2023-48926](https://cve.now/CVE-2023-48926.md): An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrar (CVSS 5.3)
- [CVE-2023-49351](https://cve.now/CVE-2023-49351.md): A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite o (CVSS 9.8)
- [CVE-2023-51059](https://cve.now/CVE-2023-51059.md): An issue in MOKO TECHNOLOGY LTD MOKOSmart MKGW1 BLE Gateway v.1.1.1 and before allows a remote attacker to escalate privileges via the sessi (CVSS 8.8)
- [CVE-2023-51257](https://cve.now/CVE-2023-51257.md): An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. (CVSS 7.8)
- [CVE-2023-51282](https://cve.now/CVE-2023-51282.md): An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter. (CVSS 7.5, net.mingsoft:ms-mcms)
- [CVE-2023-51807](https://cve.now/CVE-2023-51807.md): Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the tit (CVSS 5.4)
- [CVE-2023-51810](https://cve.now/CVE-2023-51810.md): SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information (CVSS 7.5)
- [CVE-2023-52041](https://cve.now/CVE-2023-52041.md): An issue discovered in TOTOLINK X6000R V9.4.0cu.852\_B20230719 allows attackers to run arbitrary code via the sub\_410118 function of the shtt (CVSS 9.8)
- [CVE-2023-52042](https://cve.now/CVE-2023-52042.md): An issue discovered in sub\_4117F8 function in TOTOLINK X6000R V9.4.0cu.852\_B20230719 allows attackers to run arbitrary commands via the 'lan (CVSS 8.8)
- [CVE-2023-52068](https://cve.now/CVE-2023-52068.md): kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs. (CVSS 6.1)
- [CVE-2024-22491](https://cve.now/CVE-2024-22491.md): A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content paramete (CVSS 5.4, com.ibeetl:beetl)
- [CVE-2024-22625](https://cve.now/CVE-2024-22625.md): Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply\_Management\_System/admin/edit\_category.php?id=. (CVSS 7.2)
- [CVE-2024-22626](https://cve.now/CVE-2024-22626.md): Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply\_Management\_System/admin/edit\_retailer.php?id=. (CVSS 7.2)
- [CVE-2024-22627](https://cve.now/CVE-2024-22627.md): Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply\_Management\_System/admin/edit\_distributor.php?id=. (CVSS 7.2)
- [CVE-2024-22628](https://cve.now/CVE-2024-22628.md): Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense\_budget/admin/?page=reports/budget&date\_start=2023-12-28&d (CVSS 7.2)
- [CVE-2024-22916](https://cve.now/CVE-2024-22916.md): In D-LINK Go-RT-AC750 v101b03, the sprintf function in the sub\_40E700 function within the cgibin is susceptible to stack overflow. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.