# CVEs published 2024-03-16 50 CVEs were published on March 16, 2024: 1 critical, 8 high. Days are UTC. - [CVE-2024-2534](https://cve.now/CVE-2024-2534.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System users.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2533](https://cve.now/CVE-2024-2533.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-users.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2532](https://cve.now/CVE-2024-2532.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-users.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2531](https://cve.now/CVE-2024-2531.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php unrestricted upload (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2530](https://cve.now/CVE-2024-2530.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2529](https://cve.now/CVE-2024-2529.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php unrestricted upload (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2528](https://cve.now/CVE-2024-2528.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2527](https://cve.now/CVE-2024-2527.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2526](https://cve.now/CVE-2024-2526.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2525](https://cve.now/CVE-2024-2525.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System receipt.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2524](https://cve.now/CVE-2024-2524.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System receipt.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2523](https://cve.now/CVE-2024-2523.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System booktime.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2522](https://cve.now/CVE-2024-2522.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System booktime.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2521](https://cve.now/CVE-2024-2521.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System bookdate.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2520](https://cve.now/CVE-2024-2520.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System bookdate.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2519](https://cve.now/CVE-2024-2519.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System navbar.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2518](https://cve.now/CVE-2024-2518.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System book\_history.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2517](https://cve.now/CVE-2024-2517.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System book\_history.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2516](https://cve.now/CVE-2024-2516.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System home.php sql injection (CVSS 6.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-2515](https://cve.now/CVE-2024-2515.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System home.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System) - [CVE-2024-1857](https://cve.now/CVE-2024-1857.md): Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates \<= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3, wpswings Ultimate Gift Cards for WooCommerce) - [CVE-2024-1685](https://cve.now/CVE-2024-1685.md): Social Media Share Buttons \<= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, sygnoos Social Media Share Buttons) - [CVE-2024-1733](https://cve.now/CVE-2024-1733.md): Word Replacer Pro \<= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update (CVSS 5.3, charlestsmith Word Replacer Pro) - [CVE-2024-22259](https://cve.now/CVE-2024-22259.md): CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report) (CVSS 8.1, Spring Framework · org.springframework:spring-web) - [CVE-2024-24845](https://cve.now/CVE-2024-24845.md): WordPress Post Thumbnail Editor plugin \<= 2.4.8 - Unauthenticated Sensitive Data Exposure vulnerability (CVSS 5.3, Sewpafly Post Thumbnail Editor) - [CVE-2024-23523](https://cve.now/CVE-2024-23523.md): WordPress Elementor Pro plugin \<= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability (CVSS 6.5, Elementor Pro) - [CVE-2023-6525](https://cve.now/CVE-2023-6525.md): ElementsKit Elementor addons \<= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting (CVSS 5.5, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…) - [CVE-2024-2042](https://cve.now/CVE-2024-2042.md): ElementsKit Elementor addons \<= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…) - [CVE-2024-1239](https://cve.now/CVE-2024-1239.md): ElementsKit Elementor addons \<= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…) - [CVE-2024-2294](https://cve.now/CVE-2024-2294.md): Backuply – Backup, Restore, Migrate and Clone \<= 1.2.7 - Authenticated (Admin+) Directory Traversal (CVSS 4.9, softaculous Backuply – Backup, Restore, Migrate and Clone) - [CVE-2024-2308](https://cve.now/CVE-2024-2308.md): ElementInvader Addons for Elementor \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ElementInvader Addons for Elementor) - [CVE-2024-27194](https://cve.now/CVE-2024-27194.md): WordPress Fontific plugin \<= 0.1.6 - CSRF to XSS vulnerability (CVSS 7.1, Andrei Ivasiuc Fontific | Google Fonts) - [CVE-2024-27195](https://cve.now/CVE-2024-27195.md): WordPress Watermark RELOADED plugin \<= 1.3.5 - CSRF to XSS vulnerability (CVSS 7.1, sverde1 Watermark RELOADED) - [CVE-2024-27197](https://cve.now/CVE-2024-27197.md): WordPress BeePress plugin \<= 6.9.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BeePress) - [CVE-2023-51474](https://cve.now/CVE-2023-51474.md): WordPress TerraClassifieds plugin \<= 2.0.3 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability (CVSS 8.8, Pixelemu TerraClassifieds) - [CVE-2023-51486](https://cve.now/CVE-2023-51486.md): WordPress WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin \<= 1.2.101 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, RedNao WooCommerce PDF Invoice Builder) - [CVE-2023-51487](https://cve.now/CVE-2023-51487.md): WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin \<= 1.2.32 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ARI Soft ARI Stream Quiz) - [CVE-2023-51489](https://cve.now/CVE-2023-51489.md): WordPress Crowdsignal Polls & Ratings plugin \<= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Automattic Crowdsignal Dashboard – Polls, Surveys & more) - [CVE-2023-51491](https://cve.now/CVE-2023-51491.md): WordPress Depicter Slider plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Averta Depicter Slider) - [CVE-2023-51510](https://cve.now/CVE-2023-51510.md): WordPress Export Media URLs plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Atlas Gondal Export Media URLs) - [CVE-2023-51512](https://cve.now/CVE-2023-51512.md): WordPress Product Table by WBW plugin \<= 1.8.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Product Table by WBW) - [CVE-2023-51521](https://cve.now/CVE-2023-51521.md): WordPress Quiz And Survey Master plugin \<= 8.1.18 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ExpressTech Quiz And Survey Master) - [CVE-2023-51407](https://cve.now/CVE-2023-51407.md): WordPress Split Test For Elementor plugin \<= 1.6.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rocket Elements Split Test For Elementor) - [CVE-2023-36483](https://cve.now/CVE-2023-36483.md): MAS (a Carrier brand) MASmobile Classic Authorization Bypass (CVSS 6.5, MAS (a Carrier brand) MASmobile Classic · MAS (a Carrier br…) - [CVE-2024-22513](https://cve.now/CVE-2024-22513.md): djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. (CVSS 5.5, djangorestframework-simplejwt) - [CVE-2024-24156](https://cve.now/CVE-2024-24156.md): Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attacke (CVSS 6.1) - [CVE-2024-28069](https://cve.now/CVE-2024-28069.md): A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to (CVSS 7.5) - [CVE-2024-28070](https://cve.now/CVE-2024-28070.md): A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to (CVSS 6.8) - [CVE-2024-28639](https://cve.now/CVE-2024-28639.md): Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute (CVSS 9.8) - [CVE-2024-28640](https://cve.now/CVE-2024-28640.md): Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-03-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.