# CVEs published 2024-03-07

95 CVEs were published on March 7, 2024: 15 critical, 29 high. Days are UTC.

- [CVE-2024-2272](https://cve.now/CVE-2024-2272.md): keerti1924 Online-Book-Store-Website HTTP POST Request home.php sql injection (CVSS 6.3, keerti1924 Online-Book-Store-Website)
- [CVE-2024-2271](https://cve.now/CVE-2024-2271.md): keerti1924 Online-Book-Store-Website HTTP POST Request shop.php sql injection (CVSS 6.3, keerti1924 Online-Book-Store-Website)
- [CVE-2024-2270](https://cve.now/CVE-2024-2270.md): keerti1924 Online-Book-Store-Website signup.php cross site scripting (CVSS 4.3, keerti1924 Online-Book-Store-Website)
- [CVE-2024-2269](https://cve.now/CVE-2024-2269.md): keerti1924 Online-Book-Store-Website search.php sql injection (CVSS 6.3, keerti1924 Online-Book-Store-Website)
- [CVE-2024-2268](https://cve.now/CVE-2024-2268.md): keerti1924 Online-Book-Store-Website unrestricted upload (CVSS 4.7, keerti1924 Online-Book-Store-Website)
- [CVE-2024-2267](https://cve.now/CVE-2024-2267.md): keerti1924 Online-Book-Store-Website shop.php logic error (CVSS 4.3, keerti1924 Online-Book-Store-Website)
- [CVE-2024-2266](https://cve.now/CVE-2024-2266.md): keerti1924 Secret-Coder-PHP-Project Login Page login.php cross site scripting (CVSS 3.5, keerti1924 Secret-Coder-PHP-Project)
- [CVE-2024-2265](https://cve.now/CVE-2024-2265.md): keerti1924 PHP-MYSQL-User-Login-System login.sql inclusion of sensitive information in source code (CVSS 5.3, keerti1924 PHP-MYSQL-User-Login-System)
- [CVE-2024-2264](https://cve.now/CVE-2024-2264.md): keerti1924 PHP-MYSQL-User-Login-System login.php sql injection (CVSS 7.3, keerti1924 PHP-MYSQL-User-Login-System)
- [CVE-2024-28115](https://cve.now/CVE-2024-28115.md): Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled (CVSS 8.8, FreeRTOS-Kernel)
- [CVE-2024-2044](https://cve.now/CVE-2024-2044.md): Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 (CVSS 9.9, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2023-46169](https://cve.now/CVE-2023-46169.md): IBM DS8900F file manipulation (CVSS 6.5, IBM DS8900F)
- [CVE-2023-46172](https://cve.now/CVE-2023-46172.md): IBM DS8900F security bypass (CVSS 5.6, IBM DS8900F)
- [CVE-2024-1986](https://cve.now/CVE-2024-1986.md): Elite Booster for WooCommerce \<= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, pluggabl Booster Elite for WooCommerce)
- [CVE-2024-1802](https://cve.now/CVE-2024-1802.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2023-46170](https://cve.now/CVE-2023-46170.md): IBM DS8900F information disclosure (CVSS 6.5, IBM DS8900F)
- [CVE-2023-46171](https://cve.now/CVE-2023-46171.md): IBM DS8900F information disclosure (CVSS 4.3, IBM DS8900F)
- [CVE-2024-26167](https://cve.now/CVE-2024-26167.md): Microsoft Edge for Android Spoofing Vulnerability (CVSS 4.3, Microsoft Edge for Android)
- [CVE-2024-1725](https://cve.now/CVE-2024-1725.md): Kubevirt-csi: persistentvolume allows access to hcp's root node (CVSS 6.5, kubevirt-csi-driver · Red Hat OpenShift Container Platfo… +1)
- [CVE-2024-2127](https://cve.now/CVE-2024-2127.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (CVSS 6.4, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2024-0203](https://cve.now/CVE-2024-0203.md): The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. (CVSS 8.8, UnitedOver Digits: WordPress Mobile Number Signup and Login)
- [CVE-2024-2128](https://cve.now/CVE-2024-2128.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-1773](https://cve.now/CVE-2024-1773.md): PDF Invoices and Packing Slips For WooCommerce \<= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, acowebs PDF Invoices and Packing Slips For WooCommerce)
- [CVE-2024-1442](https://cve.now/CVE-2024-1442.md): User with permissions to create a data source can CRUD all data sources (CVSS 6.0, Grafana · github.com/grafana/grafana)
- [CVE-2024-1351](https://cve.now/CVE-2024-1351.md): MongoDB Server may allow successful untrusted connection (CVSS 8.8, MongoDB Server)
- [CVE-2023-48725](https://cve.now/CVE-2023-48725.md): A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7 (CVSS 7.2, Netgear RAX30)
- [CVE-2023-42509](https://cve.now/CVE-2023-42509.md): JFrog Artifactory Sensitive Data Leakage in Repository configuration process (CVSS 6.6, JFrog Artifactory)
- [CVE-2023-42661](https://cve.now/CVE-2023-42661.md): JFrog Artifactory Improper input validation leads to arbitrary file write (CVSS 7.2, JFrog Artifactory)
- [CVE-2024-2241](https://cve.now/CVE-2024-2241.md): Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintend (CVSS 6.3, Devolutions Workspace)
- [CVE-2024-2245](https://cve.now/CVE-2024-2245.md): Cross-Site Scripting vulnerability in moziloCMS (CVSS 5.4, moziloCMS)
- [CVE-2024-0818](https://cve.now/CVE-2024-0818.md): Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6 (CVSS 9.1, paddlepaddle/paddle · paddlepaddle)
- [CVE-2024-28230](https://cve.now/CVE-2024-28230.md): In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions (CVSS 6.5, JetBrains YouTrack)
- [CVE-2024-28229](https://cve.now/CVE-2024-28229.md): In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles (CVSS 6.5, JetBrains YouTrack)
- [CVE-2024-28228](https://cve.now/CVE-2024-28228.md): In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible (CVSS 5.3, JetBrains YouTrack)
- [CVE-2024-1169](https://cve.now/CVE-2024-1169.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.7 - Missing Authorization to Unauthenticated Media Upload (CVSS 7.5, themekraft Post Form – Registration Form – Profile Form for…)
- [CVE-2024-1170](https://cve.now/CVE-2024-1170.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion (CVSS 8.2, themekraft Post Form – Registration Form – Profile Form for…)
- [CVE-2024-22256](https://cve.now/CVE-2024-22256.md): VMware Cloud Director contains a partial information disclosure vulnerability. (CVSS 4.3, VMware Cloud Director)
- [CVE-2024-1534](https://cve.now/CVE-2024-1534.md): Booster for WooCommerce \<= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde (CVSS 6.4, pluggabl Booster for WooCommerce – PDF Invoices, Abandoned…)
- [CVE-2024-1931](https://cve.now/CVE-2024-1931.md): Denial of service when trimming EDE text on positive replies (CVSS 7.5, NLnet Labs Unbound)
- [CVE-2024-1382](https://cve.now/CVE-2024-1382.md): Restaurant Reservations \<= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, nicdark Restaurant Reservations)
- [CVE-2024-2136](https://cve.now/CVE-2024-2136.md): WPKoi Templates for Elementor \<= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget (CVSS 6.4, wpkoithemes WPKoi Templates for Elementor)
- [CVE-2023-42662](https://cve.now/CVE-2023-42662.md): JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens (CVSS 9.3, JFrog Artifactory)
- [CVE-2024-0917](https://cve.now/CVE-2024-0917.md): remote code execution in paddlepaddle/paddle 2.6.0 (CVSS 9.4, paddlepaddle/paddle · paddlepaddle)
- [CVE-2024-1419](https://cve.now/CVE-2024-1419.md): The Plus Addons for Elementor \<= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-1506](https://cve.now/CVE-2024-1506.md): Prime Slider – Addons For Elementor \<= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2024-1377](https://cve.now/CVE-2024-1377.md): Happy Addons for Elementor \<= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-1500](https://cve.now/CVE-2024-1500.md): Royal Elementor Addons and Templates \<= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget (CVSS 5.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-1720](https://cve.now/CVE-2024-1720.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting (CVSS 4.7, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2024-1366](https://cve.now/CVE-2024-1366.md): Happy Addons for Elementor \<= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2023-51395](https://cve.now/CVE-2023-51395.md): Z-Wave S0 Decryption Vulnerability in End Devices (CVSS 8.8, Silicon Labs Z-Wave SDK)
- [CVE-2024-28216](https://cve.now/CVE-2024-28216.md): nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause o (CVSS 5.4, NAVER nGrinder)
- [CVE-2024-28215](https://cve.now/CVE-2024-28215.md): nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause o (CVSS 7.5, NAVER nGrinder)
- [CVE-2024-28214](https://cve.now/CVE-2024-28214.md): nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker. (CVSS 2.7, NAVER nGrinder)
- [CVE-2024-28213](https://cve.now/CVE-2024-28213.md): nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbi (CVSS 9.8, NAVER nGrinder · org.ngrinder:ngrinder-core)
- [CVE-2024-28212](https://cve.now/CVE-2024-28212.md): nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization. (CVSS 9.8, NAVER nGrinder)
- [CVE-2024-28211](https://cve.now/CVE-2024-28211.md): nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI (CVSS 9.8, NAVER nGrinder)
- [CVE-2024-1761](https://cve.now/CVE-2024-1761.md): WP Chat App \<= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4, ninjateam WP Chat App)
- [CVE-2024-28097](https://cve.now/CVE-2024-28097.md): Stored Cross-site Scripting in Calendar functionality in Schoolbox (CVSS 7.3, Schoolbox Pty Schoolbox)
- [CVE-2024-28096](https://cve.now/CVE-2024-28096.md): Stored Cross-site Scripting in Class functionality in Schoolbox (CVSS 7.3, Schoolbox Pty Schoolbox)
- [CVE-2024-28095](https://cve.now/CVE-2024-28095.md): Stored Cross-site Scripting in News functionality in Schoolbox (CVSS 7.3, Schoolbox Pty Schoolbox)
- [CVE-2024-28094](https://cve.now/CVE-2024-28094.md): Blind SQL Injection in Chat functionality in Schoolbox (CVSS 8.8, Schoolbox Pty Schoolbox)
- [CVE-2024-0815](https://cve.now/CVE-2024-0815.md): Command injection in paddle.utils.download.\_wget\_download (bypass filter) in paddlepaddle/paddle 2.6.0 (CVSS 9.3, paddlepaddle/paddle · paddlepaddle)
- [CVE-2024-1460](https://cve.now/CVE-2024-1460.md): MSI Afterburner v4.6.5.16370 - Kernel Memory Leak (CVSS 5.6, MSI Afterburner)
- [CVE-2024-1443](https://cve.now/CVE-2024-1443.md): MSI Afterburner v4.6.5.16370 - Denial of Service (CVSS 4.4, MSI Afterburner)
- [CVE-2024-0817](https://cve.now/CVE-2024-0817.md): Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0 (CVSS 9.3, paddlepaddle/paddle · paddlepaddle)
- [CVE-2024-0199](https://cve.now/CVE-2024-0199.md): Incorrect Authorization in GitLab (CVSS 7.7, GitLab)
- [CVE-2024-1299](https://cve.now/CVE-2024-1299.md): Privilege Chaining in GitLab (CVSS 6.5, GitLab)
- [CVE-2022-46089](https://cve.now/CVE-2022-46089.md): Cross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute (CVSS 6.1)
- [CVE-2022-46091](https://cve.now/CVE-2022-46091.md): Cross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute ar (CVSS 4.7)
- [CVE-2022-46497](https://cve.now/CVE-2022-46497.md): Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat\_number parameter at his\_doc\_view\_single\_p (CVSS 8.1)
- [CVE-2022-46498](https://cve.now/CVE-2022-46498.md): Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc\_number parameter at his\_admin\_view\_single (CVSS 2.7)
- [CVE-2022-46499](https://cve.now/CVE-2022-46499.md): Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat\_number parameter at his\_admin\_view\_single (CVSS 8.8)
- [CVE-2023-33676](https://cve.now/CVE-2023-33676.md): Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=\*" whi (CVSS 8.4)
- [CVE-2023-41014](https://cve.now/CVE-2023-41014.md): code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer." (CVSS 9.8)
- [CVE-2023-41015](https://cve.now/CVE-2023-41015.md): code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via /Employer/DeleteJob.php?JobId=1. (CVSS 5.5)
- [CVE-2023-41503](https://cve.now/CVE-2023-41503.md): Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function. (CVSS 9.8)
- [CVE-2023-47415](https://cve.now/CVE-2023-47415.md): Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli\_text parameter. (CVSS 7.5)
- [CVE-2023-49986](https://cve.now/CVE-2023-49986.md): A cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow attackers to execute ar (CVSS 4.7)
- [CVE-2023-49987](https://cve.now/CVE-2023-49987.md): A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execu (CVSS 5.4)
- [CVE-2023-49988](https://cve.now/CVE-2023-49988.md): Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php. (CVSS 7.5)
- [CVE-2023-49989](https://cve.now/CVE-2023-49989.md): Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php. (CVSS 9.8)
- [CVE-2023-51281](https://cve.now/CVE-2023-51281.md): Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script fir (CVSS 5.4)
- [CVE-2023-51786](https://cve.now/CVE-2023-51786.md): An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sens (CVSS 9.1)
- [CVE-2024-22752](https://cve.now/CVE-2024-22752.md): Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable (CVSS 8.1)
- [CVE-2024-22857](https://cve.now/CVE-2024-22857.md): Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog\_rule\_new().The size of record\_name is MAXLEN\_PATH(1024) + 1 but file\_path may have (CVSS 9.8)
- [CVE-2024-24035](https://cve.now/CVE-2024-24035.md): Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter. (CVSS 6.1)
- [CVE-2024-24375](https://cve.now/CVE-2024-24375.md): SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. (CVSS 7.5)
- [CVE-2024-24389](https://cve.now/CVE-2024-24389.md): A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 6.1)
- [CVE-2024-25327](https://cve.now/CVE-2024-25327.md): Cross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code vi (CVSS 6.1)
- [CVE-2024-25729](https://cve.now/CVE-2024-25729.md): Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (CVSS 8.8)
- [CVE-2024-26492](https://cve.now/CVE-2024-26492.md): An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POS (CVSS 6.3)
- [CVE-2024-26566](https://cve.now/CVE-2024-26566.md): An issue in Cute Http File Server v.3.1 allows a remote attacker to escalate privileges via the password verification component. (CVSS 8.2)
- [CVE-2024-27707](https://cve.now/CVE-2024-27707.md): Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload (CVSS 4.3)
- [CVE-2024-27733](https://cve.now/CVE-2024-27733.md): File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the use (CVSS 7.7)
- [CVE-2024-28222](https://cve.now/CVE-2024-28222.md): In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an u (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.