# CVEs published 2024-03-17

31 CVEs were published on March 17, 2024: 1 critical, 11 high. Days are UTC.

- [CVE-2024-23139](https://cve.now/CVE-2024-23139.md): ActionScript Byte Code “ABC” Vulnerability in the Autodesk FBX Review software (CVSS 7.8, Autodesk FBX Review)
- [CVE-2024-23138](https://cve.now/CVE-2024-23138.md): Stack-based Overflow Vulnerability in the TrueViewTM Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +2)
- [CVE-2024-2569](https://cve.now/CVE-2024-2569.md): SourceCodester Employee Task Management System admin-manage-user.php redirect (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2024-2568](https://cve.now/CVE-2024-2568.md): heyewei JFinalCMS Custom Data Page sql injection (CVSS 4.7, heyewei JFinalCMS)
- [CVE-2024-2567](https://cve.now/CVE-2024-2567.md): jurecapuder AndroidWeatherApp Backup File androidmanifest.xml backup (CVSS 1.8, jurecapuder AndroidWeatherApp)
- [CVE-2024-27961](https://cve.now/CVE-2024-27961.md): WordPress AntiSpam for Contact Form 7 plugin \<= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Codekraft AntiSpam for Contact Form)
- [CVE-2024-27960](https://cve.now/CVE-2024-27960.md): WordPress Email Subscription Popup plugin \<= 1.2.20 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, I Thirteen Web Solution Email Subscription Popup)
- [CVE-2024-27959](https://cve.now/CVE-2024-27959.md): WordPress APIExperts Square for WooCommerce plugin \<= 4.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce…)
- [CVE-2024-27958](https://cve.now/CVE-2024-27958.md): WordPress Visualizer plugin \<= 3.10.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Themeisle Visualizer)
- [CVE-2024-27957](https://cve.now/CVE-2024-27957.md): WordPress Pie Register plugin \<= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, Pie Register)
- [CVE-2024-25903](https://cve.now/CVE-2024-25903.md): WordPress Frontend File Manager Plugin plugin \<= 22.7 - Sensitive Data Exposure vulnerability (CVSS 5.3, N-Media Frontend File Manager)
- [CVE-2024-25591](https://cve.now/CVE-2024-25591.md): WordPress WP Editor plugin \<=1.2.7 - Sensitive Data Exposure vulnerability (CVSS 5.3, Benjamin Rojas WP Editor)
- [CVE-2024-24867](https://cve.now/CVE-2024-24867.md): WordPress WP Stats Manager plugin \<= 6.9.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, Osamaesh WP Visitor Statistics)
- [CVE-2024-25933](https://cve.now/CVE-2024-25933.md): WordPress PeproDev Ultimate Invoice plugin \<= 1.9.7 - Sensitive Data Exposure vulnerability (CVSS 5.3, Pepro Dev. Group PeproDev Ultimate Invoice)
- [CVE-2024-2566](https://cve.now/CVE-2024-2566.md): Fujian Kelixin Communication Command and Dispatch Platform get\_extension\_yl.php sql injection (CVSS 7.3, Fujian Kelixin Communication Command and Dispatch Platform)
- [CVE-2024-2565](https://cve.now/CVE-2024-2565.md): PandaXGO PandaX File Extension upload.go unrestricted upload (CVSS 6.3, PandaXGO PandaX)
- [CVE-2024-2564](https://cve.now/CVE-2024-2564.md): PandaXGO PandaX user.go ExportUser path traversal (CVSS 6.3, PandaXGO PandaX)
- [CVE-2024-2563](https://cve.now/CVE-2024-2563.md): PandaXGO PandaX upload.go DeleteImage path traversal (CVSS 5.4, PandaXGO PandaX)
- [CVE-2024-2562](https://cve.now/CVE-2024-2562.md): PandaXGO PandaX role\_menu.go InsertRole sql injection (CVSS 6.3, PandaXGO PandaX)
- [CVE-2024-2561](https://cve.now/CVE-2024-2561.md): 74CMS Company Logo Index.php#sendCompanyLogo unrestricted upload (CVSS 6.3, 74CMS)
- [CVE-2024-2560](https://cve.now/CVE-2024-2560.md): Tenda AC18 SysToolRestoreSet fromSysToolRestoreSet cross-site request forgery (CVSS 4.3, Tenda AC18)
- [CVE-2024-2559](https://cve.now/CVE-2024-2559.md): Tenda AC18 SysToolReboot fromSysToolReboot cross-site request forgery (CVSS 4.3, Tenda AC18)
- [CVE-2024-2558](https://cve.now/CVE-2024-2558.md): Tenda AC18 execCommand formexeCommand stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2557](https://cve.now/CVE-2024-2557.md): kishor-23 Food Waste Management System admin.php improper authorization (CVSS 5.3, kishor-23 Food Waste Management System)
- [CVE-2024-2556](https://cve.now/CVE-2024-2556.md): SourceCodester Employee Task Management System attendance-info.php sql injection (CVSS 6.3, SourceCodester Employee Task Management System)
- [CVE-2024-2555](https://cve.now/CVE-2024-2555.md): SourceCodester Employee Task Management System update-admin.php sql injection (CVSS 6.3, SourceCodester Employee Task Management System)
- [CVE-2024-2554](https://cve.now/CVE-2024-2554.md): SourceCodester Employee Task Management System update-employee.php sql injection (CVSS 6.3, SourceCodester Employee Task Management System)
- [CVE-2024-2553](https://cve.now/CVE-2024-2553.md): SourceCodester Product Review Rating System Rate Product cross site scripting (CVSS 3.5, SourceCodester Product Review Rating System)
- [CVE-2024-2547](https://cve.now/CVE-2024-2547.md): Tenda AC18 R7WebsSecurityHandler stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2546](https://cve.now/CVE-2024-2546.md): Tenda AC18 fromSetWirelessRepeat stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2535](https://cve.now/CVE-2024-2535.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System users.php cross site scripting (CVSS 3.5, MAGESH-K21 Online-College-Event-Hall-Reservation-System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.