# CVEs published 2024-03-27

285 CVEs were published on March 27, 2024: 11 critical, 112 high. Days are UTC.

- [CVE-2024-3010](https://cve.now/CVE-2024-3010.md): Tenda FH1205 setcfm formSetCfm stack-based overflow (CVSS 8.8, Tenda FH1205)
- [CVE-2024-3009](https://cve.now/CVE-2024-3009.md): Tenda FH1205 WriteFacMac formWriteFacMac command injection (CVSS 6.3, Tenda FH1205)
- [CVE-2024-0980](https://cve.now/CVE-2024-0980.md): The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. (CVSS 7.1, Okta Verify for Windows)
- [CVE-2024-3008](https://cve.now/CVE-2024-3008.md): Tenda FH1205 execCommand formexeCommand stack-based overflow (CVSS 8.8, Tenda FH1205)
- [CVE-2024-3007](https://cve.now/CVE-2024-3007.md): Tenda FH1205 NatStaticSetting fromNatStaticSetting stack-based overflow (CVSS 8.8, Tenda FH1205)
- [CVE-2024-3006](https://cve.now/CVE-2024-3006.md): Tenda FH1205 fromRouteStatic fromSetRouteStatic stack-based overflow (CVSS 8.8, Tenda FH1205)
- [CVE-2024-3004](https://cve.now/CVE-2024-3004.md): code-projects Online Book System Product.php cross site scripting (CVSS 3.5, code-projects Online Book System)
- [CVE-2024-3003](https://cve.now/CVE-2024-3003.md): code-projects Online Book System cart.php sql injection (CVSS 6.3, code-projects Online Book System)
- [CVE-2024-3002](https://cve.now/CVE-2024-3002.md): code-projects Online Book System description.php sql injection (CVSS 6.3, code-projects Online Book System)
- [CVE-2024-0079](https://cve.now/CVE-2024-0079.md): CVE (CVSS 6.5, nvidia vGPU driver, Cloud Gaming driver)
- [CVE-2024-0077](https://cve.now/CVE-2024-0077.md): CVE (CVSS 7.8, nvidia vGPU driver, Cloud Gaming driver)
- [CVE-2024-0075](https://cve.now/CVE-2024-0075.md): CVE (CVSS 6.1, nvidia GPU Display driver, vGPU driver, Cloud Gaming driver)
- [CVE-2024-0078](https://cve.now/CVE-2024-0078.md): CVE (CVSS 6.5, nvidia GPU Display driver, vGPU driver, Cloud Gaming driver)
- [CVE-2024-0074](https://cve.now/CVE-2024-0074.md): CVE (CVSS 7.1, nvidia GPU Display driver, vGPU driver, Cloud Gaming driver)
- [CVE-2024-0073](https://cve.now/CVE-2024-0073.md): CVE (CVSS 7.8, nvidia GPU Display driver, vGPU driver, Cloud Gaming driver)
- [CVE-2024-0071](https://cve.now/CVE-2024-0071.md): CVE (CVSS 7.8, nvidia GPU Display driver, vGPU driver, Cloud Gaming driver)
- [CVE-2024-3001](https://cve.now/CVE-2024-3001.md): code-projects Online Book System Product.php sql injection (CVSS 6.3, code-projects Online Book System)
- [CVE-2024-3000](https://cve.now/CVE-2024-3000.md): code-projects Online Book System index.php sql injection (CVSS 7.3, code-projects Online Book System)
- [CVE-2024-2999](https://cve.now/CVE-2024-2999.md): Campcodes Online Art Gallery Management System adminHome.php sql injection (CVSS 6.3, Campcodes Online Art Gallery Management System)
- [CVE-2024-2998](https://cve.now/CVE-2024-2998.md): Bdtask Multi-Store Inventory Management System Store Update Page cross site scripting (CVSS 2.4, Bdtask Multi-Store Inventory Management System)
- [CVE-2024-2997](https://cve.now/CVE-2024-2997.md): Bdtask Multi-Store Inventory Management System cross site scripting (CVSS 2.4, Bdtask Multi-Store Inventory Management System)
- [CVE-2024-2996](https://cve.now/CVE-2024-2996.md): Bdtask Multi-Store Inventory Management System Page Title cross site scripting (CVSS 2.4, Bdtask Multi-Store Inventory Management System)
- [CVE-2024-2995](https://cve.now/CVE-2024-2995.md): NUUO Camera deletefile.php denial of service (CVSS 5.4, NUUO Camera)
- [CVE-2024-29892](https://cve.now/CVE-2024-29892.md): ZITADEL's actions can overload reserved claims (CVSS 6.1, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-2994](https://cve.now/CVE-2024-2994.md): Tenda FH1203 GetParentControlInfo stack-based overflow (CVSS 8.8, Tenda FH1203)
- [CVE-2024-2993](https://cve.now/CVE-2024-2993.md): Tenda FH1203 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda FH1203)
- [CVE-2024-29891](https://cve.now/CVE-2024-29891.md): ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass (CVSS 8.7, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-2992](https://cve.now/CVE-2024-2992.md): Tenda FH1203 setcfm formSetCfm stack-based overflow (CVSS 8.8, Tenda FH1203)
- [CVE-2024-29888](https://cve.now/CVE-2024-29888.md): Saleor vulnerable to customers addresses leak when using Warehouse as a \`Pickup: Local stock only\` delivery method (CVSS 4.2, saleor)
- [CVE-2024-29887](https://cve.now/CVE-2024-29887.md): Serverpod client accepts any certificate (CVSS 7.4, serverpod)
- [CVE-2024-29886](https://cve.now/CVE-2024-29886.md): Improved security for stored password hashes (CVSS 5.3, serverpod)
- [CVE-2024-28860](https://cve.now/CVE-2024-28860.md): Insecure IPsec transport encryption in Cilium (CVSS 8.0, cilium · github.com/cilium/cilium)
- [CVE-2024-2991](https://cve.now/CVE-2024-2991.md): Tenda FH1203 WriteFacMac formWriteFacMac command injection (CVSS 6.3, Tenda FH1203)
- [CVE-2024-2990](https://cve.now/CVE-2024-2990.md): Tenda FH1203 execCommand formexeCommand stack-based overflow (CVSS 8.8, Tenda FH1203)
- [CVE-2024-28247](https://cve.now/CVE-2024-28247.md): Pihole Authenticated Arbitrary File Read with root privileges (CVSS 7.6, pi-hole)
- [CVE-2024-28233](https://cve.now/CVE-2024-28233.md): XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing (CVSS 8.1, jupyterhub)
- [CVE-2024-23451](https://cve.now/CVE-2024-23451.md): Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model (CVSS 4.4, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-2989](https://cve.now/CVE-2024-2989.md): Tenda FH1203 NatStaticSetting fromNatStaticSetting stack-based overflow (CVSS 8.8, Tenda FH1203)
- [CVE-2024-2988](https://cve.now/CVE-2024-2988.md): Tenda FH1203 fromRouteStatic fromSetRouteStatic stack-based overflow (CVSS 8.8, Tenda FH1203)
- [CVE-2024-20307](https://cve.now/CVE-2024-20307.md): A vulnerability in the IKEv1 fragmentation code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attac (CVSS 6.8, Cisco IOS)
- [CVE-2024-20308](https://cve.now/CVE-2024-20308.md): A vulnerability in the IKEv1 fragmentation code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attac (CVSS 8.6, Cisco IOS)
- [CVE-2023-0582](https://cve.now/CVE-2023-0582.md): Path Traversal in ForgeRock Access Managment (CVSS 8.1, forgerock access management)
- [CVE-2024-20271](https://cve.now/CVE-2024-20271.md): A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a d (CVSS 8.6, Cisco Aironet Access Point Software · Cisco Business Wirele…)
- [CVE-2024-20265](https://cve.now/CVE-2024-20265.md): A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisc (CVSS 5.9, Cisco IOS XE Software · Cisco Aironet Access Point Softw… +1)
- [CVE-2024-23450](https://cve.now/CVE-2024-23450.md): Elasticsearch Uncontrolled Resource Consumption vulnerability (CVSS 4.9, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-20309](https://cve.now/CVE-2024-20309.md): A vulnerability in auxiliary asynchronous port (AUX) functions of Cisco IOS XE Software could allow an authenticated, local attacker to caus (CVSS 5.6, Cisco IOS XE Software)
- [CVE-2024-20303](https://cve.now/CVE-2024-20303.md): A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unau (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2024-2987](https://cve.now/CVE-2024-2987.md): Tenda FH1202 GetParentControlInfo stack-based overflow (CVSS 8.8, Tenda FH1202)
- [CVE-2024-20278](https://cve.now/CVE-2024-20278.md): A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root (CVSS 6.5, Cisco IOS XE Software)
- [CVE-2024-20306](https://cve.now/CVE-2024-20306.md): A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker (CVSS 6.0, Cisco IOS XE Software)
- [CVE-2024-20314](https://cve.now/CVE-2024-20314.md): A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could allow an unauthentic (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2024-20312](https://cve.now/CVE-2024-20312.md): A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS Software and Cisco IOS XE Software could all (CVSS 7.4, Cisco IOS)
- [CVE-2024-20324](https://cve.now/CVE-2024-20324.md): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to access WLAN configuratio (CVSS 5.5, Cisco IOS XE Software)
- [CVE-2024-20259](https://cve.now/CVE-2024-20259.md): A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2024-20276](https://cve.now/CVE-2024-20276.md): A vulnerability in Cisco IOS Software for Cisco Catalyst 6000 Series Switches could allow an unauthenticated, adjacent attacker to cause an (CVSS 7.4, Cisco IOS)
- [CVE-2024-20311](https://cve.now/CVE-2024-20311.md): A vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthen (CVSS 8.6, Cisco IOS)
- [CVE-2024-20316](https://cve.now/CVE-2024-20316.md): A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to acces (CVSS 5.8, Cisco IOS XE Software)
- [CVE-2024-20354](https://cve.now/CVE-2024-20354.md): A vulnerability in the handling of encrypted wireless frames of Cisco Aironet Access Point (AP) Software could allow an unauthenticated, adj (CVSS 4.7, Cisco Aironet Access Point Software)
- [CVE-2024-20333](https://cve.now/CVE-2024-20333.md): A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, rem (CVSS 4.3, Cisco Digital Network Architecture Center)
- [CVE-2024-2986](https://cve.now/CVE-2024-2986.md): Tenda FH1202 SetSpeedWan formSetSpeedWan stack-based overflow (CVSS 8.8, Tenda FH1202)
- [CVE-2024-2985](https://cve.now/CVE-2024-2985.md): Tenda FH1202 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda FH1202)
- [CVE-2024-29945](https://cve.now/CVE-2024-29945.md): Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise (CVSS 7.2, Splunk Enterprise)
- [CVE-2024-29946](https://cve.now/CVE-2024-29946.md): Risky command safeguards bypass in Dashboard Examples Hub (CVSS 8.1, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-2984](https://cve.now/CVE-2024-2984.md): Tenda FH1202 setcfm formSetCfm stack-based overflow (CVSS 8.8, Tenda FH1202)
- [CVE-2024-2983](https://cve.now/CVE-2024-2983.md): Tenda FH1202 SetClientState formSetClientState stack-based overflow (CVSS 8.8, Tenda FH1202)
- [CVE-2024-1540](https://cve.now/CVE-2024-1540.md): Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow (CVSS 8.6, gradio-app/gradio)
- [CVE-2024-2982](https://cve.now/CVE-2024-2982.md): Tenda FH1202 WriteFacMac formWriteFacMac command injection (CVSS 5.5, Tenda FH1202)
- [CVE-2024-2981](https://cve.now/CVE-2024-2981.md): Tenda FH1202 fast\_setting\_wifi\_set form\_fast\_setting\_wifi\_set stack-based overflow (CVSS 8.8, Tenda FH1202)
- [CVE-2024-2980](https://cve.now/CVE-2024-2980.md): Tenda FH1202 execCommand formexeCommand stack-based overflow (CVSS 8.8, Tenda FH1202)
- [CVE-2024-2979](https://cve.now/CVE-2024-2979.md): Tenda F1203 openSchedWifi setSchedWifi stack-based overflow (CVSS 8.8, Tenda F1203)
- [CVE-2024-2978](https://cve.now/CVE-2024-2978.md): Tenda F1203 setcfm formSetCfm stack-based overflow (CVSS 8.8, Tenda F1203)
- [CVE-2024-26652](https://cve.now/CVE-2024-26652.md): net: pds\_core: Fix possible double free in error handling path (CVSS 4.1, Linux)
- [CVE-2024-26651](https://cve.now/CVE-2024-26651.md): sr9800: Add check for usbnet\_get\_endpoints (no CVSS, Linux)
- [CVE-2022-45847](https://cve.now/CVE-2022-45847.md): WordPress Countdown Widget plugin \<= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) (CVSS 6.1, WPAssist.me WordPress Countdown Widget)
- [CVE-2024-30238](https://cve.now/CVE-2024-30238.md): WordPress Photos and Files Contest Gallery plugin \<= 21.3.2 - SQL Injection vulnerability (CVSS 8.5, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2024-23510](https://cve.now/CVE-2024-23510.md): WordPress Don't Muck My Markup plugin \<= 1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Martyn Chamberlin Don't Muck My Markup)
- [CVE-2024-23515](https://cve.now/CVE-2024-23515.md): WordPress Cincopa video and media plugin \<= 1.159 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Cincopa Post Video Players)
- [CVE-2024-2977](https://cve.now/CVE-2024-2977.md): Tenda F1203 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda F1203)
- [CVE-2024-2976](https://cve.now/CVE-2024-2976.md): Tenda F1203 execCommand R7WebsSecurityHandler stack-based overflow (CVSS 8.8, Tenda F1203)
- [CVE-2023-39311](https://cve.now/CVE-2023-39311.md): WordPress Avada Builder plugin \<= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, ThemeFusion Fusion Builder)
- [CVE-2023-44999](https://cve.now/CVE-2023-44999.md): WordPress WooCommerce Stripe Gateway plugin \<= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WooCommerce Stripe Payment Gateway)
- [CVE-2023-34020](https://cve.now/CVE-2023-34020.md): WordPress Uncanny Toolkit for LearnDash plugin \<= 3.6.4.3 - Open Redirection vulnerability (CVSS 4.7, Uncanny Owl Uncanny Toolkit for LearnDash)
- [CVE-2024-29773](https://cve.now/CVE-2024-29773.md): WordPress BizPrint plugin \<= 4.5.5 - CSRF to XSS vulnerability (CVSS 7.1, BizSwoop a CPF Concepts, LLC Brand BizPrint)
- [CVE-2024-29758](https://cve.now/CVE-2024-29758.md): WordPress Co-marquage service-public.fr plugin \<= 0.5.72 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kienso Co-marquage service-public.fr)
- [CVE-2024-28852](https://cve.now/CVE-2024-28852.md): Ampache has multiple reflective XSS vulnerabilities (CVSS 6.1, ampache)
- [CVE-2024-28853](https://cve.now/CVE-2024-28853.md): Ampache Stored XSS (CVSS 3.9, ampache)
- [CVE-2024-29759](https://cve.now/CVE-2024-29759.md): WordPress Calculated Fields Form plugin \<= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CodePeople Calculated Fields Form)
- [CVE-2024-29760](https://cve.now/CVE-2024-29760.md): WordPress Booster for WooCommerce plugin \<= 7.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pluggabl Booster for WooCommerce)
- [CVE-2024-29761](https://cve.now/CVE-2024-29761.md): WordPress WP Post Disclaimer plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Krunal Prajapati WP Post Disclaimer)
- [CVE-2024-29762](https://cve.now/CVE-2024-29762.md): WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin \<= 0.5.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jory Hogeveen Off-Canvas Sidebars & Menus)
- [CVE-2024-29763](https://cve.now/CVE-2024-29763.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-29764](https://cve.now/CVE-2024-29764.md): WordPress Molongui plugin \<= 4.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Molongui)
- [CVE-2024-29765](https://cve.now/CVE-2024-29765.md): WordPress Aparat for WordPress plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alireza Sedghi Aparat for WordPress)
- [CVE-2024-29766](https://cve.now/CVE-2024-29766.md): WordPress StreamWeasels Twitch Integration plugin \<= 1.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, StreamWeasels Twitch Integration)
- [CVE-2024-29767](https://cve.now/CVE-2024-29767.md): WordPress Doneren met Mollie plugin \<= 2.10.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Wobbie.nl Doneren met Mollie)
- [CVE-2024-29768](https://cve.now/CVE-2024-29768.md): WordPress Astra theme \<= 4.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Brainstorm Force Astra)
- [CVE-2024-29769](https://cve.now/CVE-2024-29769.md): WordPress Portfolio Gallery plugin \<= 1.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Portfolio Gallery – Image Gallery Plugin)
- [CVE-2024-27091](https://cve.now/CVE-2024-27091.md): GeoNode stored XSS to full account takeover (CVSS 6.1, geonode)
- [CVE-2024-29777](https://cve.now/CVE-2024-29777.md): WordPress Forminator plugin \<= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPMU DEV - Your All-in-One WordPress Platform Forminator)
- [CVE-2024-29770](https://cve.now/CVE-2024-29770.md): WordPress Pretty Links plugin \<= 3.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shortlinks by Pretty Links)
- [CVE-2024-29771](https://cve.now/CVE-2024-29771.md): WordPress Dracula Dark Mode plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SoftLab Dracula Dark Mode - The Revolutionary Dark Mode Plu…)
- [CVE-2024-29772](https://cve.now/CVE-2024-29772.md): WordPress MyBookTable Bookstore plugin \<= 3.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Stormhill Media MyBookTable Bookstore)
- [CVE-2024-29774](https://cve.now/CVE-2024-29774.md): WordPress WP Directory Kit plugin \<= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WpDirectoryKit WP Directory Kit)
- [CVE-2024-29775](https://cve.now/CVE-2024-29775.md): WordPress Frontend Dashboard plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, vinoth06. Frontend Dashboard)
- [CVE-2024-29792](https://cve.now/CVE-2024-29792.md): WordPress Unlimited Elements for Elementor plugin \<= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unlimited Elements For Elementor)
- [CVE-2024-29790](https://cve.now/CVE-2024-29790.md): WordPress Squirrly SEO plugin \<= 12.3.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SEO Plugin by Squirrly SEO)
- [CVE-2024-29776](https://cve.now/CVE-2024-29776.md): WordPress EventPrime plugin \<= 3.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Metagauss EventPrime)
- [CVE-2024-29788](https://cve.now/CVE-2024-29788.md): WordPress Podlove Web Player plugin \<= 5.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Podlove Web Player)
- [CVE-2024-29789](https://cve.now/CVE-2024-29789.md): WordPress OneClick Chat to Order plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Walter Pinem OneClick Chat to Order)
- [CVE-2024-29791](https://cve.now/CVE-2024-29791.md): WordPress Bulk NoIndex & NoFollow Toolkit plugin \<= 2.01 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mad Fish Digital Bulk NoIndex & NoFollow Toolkit)
- [CVE-2024-27270](https://cve.now/CVE-2024-27270.md): IBM WebSphere Application Server Liberty cross-site scripting (CVSS 4.7, IBM WebSphere Application Server Liberty)
- [CVE-2024-29793](https://cve.now/CVE-2024-29793.md): WordPress MailChimp Forms by MailMunch plugin \<= 3.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MailChimp Forms by MailMunch)
- [CVE-2024-29794](https://cve.now/CVE-2024-29794.md): WordPress Conversios.io plugin \<= 6.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Conversios.io)
- [CVE-2023-50961](https://cve.now/CVE-2023-50961.md): IBM QRadar cross-site scripting (CVSS 4.8, IBM QRadar SIEM)
- [CVE-2024-28784](https://cve.now/CVE-2024-28784.md): IBM QRadar cross-site scripting (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2024-29795](https://cve.now/CVE-2024-29795.md): WordPress Media Cloud for Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean Spaces and more plugin \<= 4.5.24 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud…)
- [CVE-2023-6400](https://cve.now/CVE-2023-6400.md): Incorrect user authorization vulnerability on OpenText ZENworks Configuration Management (ZCM) product. (CVSS 7.4, OpenText™ ZENworks Configuration Management)
- [CVE-2024-29796](https://cve.now/CVE-2024-29796.md): WordPress Hot Random Image plugin \<= 1.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hot Themes Hot Random Image)
- [CVE-2024-29797](https://cve.now/CVE-2024-29797.md): WordPress Grid Shortcodes plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Darko Grid Shortcodes)
- [CVE-2024-29798](https://cve.now/CVE-2024-29798.md): WordPress Gratisfaction plugin \<= 4.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Appsmav Gratisfaction)
- [CVE-2024-29799](https://cve.now/CVE-2024-29799.md): WordPress WP Fast Total Search plugin \<= 1.59.211 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Epsiloncool WP Fast Total Search)
- [CVE-2024-29801](https://cve.now/CVE-2024-29801.md): WordPress Fullscreen Galleria plugin \<= 1.6.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Petri Damstén Fullscreen Galleria)
- [CVE-2024-29802](https://cve.now/CVE-2024-29802.md): WordPress Football Pool plugin \<= 2.11.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Antoine Hurkmans Football Pool)
- [CVE-2024-29803](https://cve.now/CVE-2024-29803.md): WordPress FlatPM plugin \< 3.1.05 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mehanoid.pro FlatPM)
- [CVE-2024-29804](https://cve.now/CVE-2024-29804.md): WordPress Fancy Comments WordPress plugin \<= 1.2.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Team Heateor Fancy Comments WordPress)
- [CVE-2024-29805](https://cve.now/CVE-2024-29805.md): WordPress Shipping with Venipak for WooCommerce plugin \<= 1.19.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ShopUp Shipping with Venipak for WooCommerce)
- [CVE-2024-29806](https://cve.now/CVE-2024-29806.md): WordPress ReDi Restaurant Reservation plugin \<= 24.0128 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Reservation Diary ReDi Restaurant Reservation)
- [CVE-2024-29807](https://cve.now/CVE-2024-29807.md): WordPress DearFlip plugin \<= 2.2.26 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DearHive DearFlip)
- [CVE-2024-29811](https://cve.now/CVE-2024-29811.md): WordPress Radio Player plugin \<= 2.0.73 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SoftLab Radio Player)
- [CVE-2024-29812](https://cve.now/CVE-2024-29812.md): WordPress ReviewX plugin \<= 1.6.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ReviewX)
- [CVE-2023-6153](https://cve.now/CVE-2023-6153.md): Authentication Bypass in TeoSOFT Software TeoBASE (CVSS 9.8, TeoSOFT Software TeoBASE)
- [CVE-2023-6173](https://cve.now/CVE-2023-6173.md): SQLi in TeoSOFT Software TeoBASE (CVSS 9.8, TeoSOFT Software TeoBASE)
- [CVE-2024-29813](https://cve.now/CVE-2024-29813.md): WordPress CartFlows plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Funnel Builder by CartFlows)
- [CVE-2024-29814](https://cve.now/CVE-2024-29814.md): WordPress Exchange Rates Widget plugin \<= 1.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CurrencyRate.today Exchange Rates Widget)
- [CVE-2024-29815](https://cve.now/CVE-2024-29815.md): WordPress WP Change Email Sender plugin \< 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Aminur Islam WP Change Email Sender)
- [CVE-2024-29816](https://cve.now/CVE-2024-29816.md): WordPress Woo Viet plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, htdat Woo Viet)
- [CVE-2024-29817](https://cve.now/CVE-2024-29817.md): WordPress affiliate-toolkit – WordPress Affiliate Plugin plugin \<= 3.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SERVIT Software Solutions affiliate-toolkit)
- [CVE-2024-29818](https://cve.now/CVE-2024-29818.md): WordPress WP Poll Maker plugin \<= 3.1 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker)
- [CVE-2024-30186](https://cve.now/CVE-2024-30186.md): WordPress Prime Slider plugin \<= 3.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Prime Slider – Addons For Elementor)
- [CVE-2024-30185](https://cve.now/CVE-2024-30185.md): WordPress Element Pack Elementor Addons plugin \<= 5.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Element Pack Elementor Addons)
- [CVE-2024-30184](https://cve.now/CVE-2024-30184.md): WordPress Popup Builder plugin \<= 4.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Looking Forward Software Incorporated. Popup Builder)
- [CVE-2024-30183](https://cve.now/CVE-2024-30183.md): WordPress WPBakery Page Builder Addons by Livemesh plugin \<= 3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Livemesh Addons for WPBakery Page Builder)
- [CVE-2024-30182](https://cve.now/CVE-2024-30182.md): WordPress HT Mega – Absolute Addons For Elementor plugin \<= 2.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DevItems HT Mega)
- [CVE-2024-30181](https://cve.now/CVE-2024-30181.md): WordPress Locatoraid Store Locator plugin \<= 3.9.30 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Plainware Locatoraid Store Locator)
- [CVE-2024-30180](https://cve.now/CVE-2024-30180.md): WordPress Easy Social Feed plugin \<= 6.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Easy Social Feed)
- [CVE-2024-30179](https://cve.now/CVE-2024-30179.md): WordPress Bold Page Builder plugin \<= 4.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BoldThemes Bold Page Builder)
- [CVE-2024-25962](https://cve.now/CVE-2024-25962.md): Dell InsightIQ, version 5.0, contains an improper access control vulnerability. (CVSS 8.3, Dell InsightIQ)
- [CVE-2024-30178](https://cve.now/CVE-2024-30178.md): WordPress Simply Static plugin \<= 3.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Simply Static)
- [CVE-2024-30177](https://cve.now/CVE-2024-30177.md): WordPress Exclusive Addons for Elementor plugin \<= 2.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Exclusive Addons Elementor)
- [CVE-2024-29936](https://cve.now/CVE-2024-29936.md): WordPress Image Hover Effects – Elementor Addon plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Blocksera Image Hover Effects – Elementor Addon)
- [CVE-2024-29935](https://cve.now/CVE-2024-29935.md): WordPress Sina Extension for Elementor plugin \<= 3.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SinaExtra Sina Extension for Elementor)
- [CVE-2024-29934](https://cve.now/CVE-2024-29934.md): WordPress Piotnet Addons For Elementor plugin \<= 2.4.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Piotnet Addons For Elementor)
- [CVE-2024-29819](https://cve.now/CVE-2024-29819.md): WordPress WPFront Notification Bar plugin \<= 3.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Syam Mohan WPFront Notification Bar)
- [CVE-2024-29933](https://cve.now/CVE-2024-29933.md): WordPress Web Icons plugin \<= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Web Icons)
- [CVE-2024-29932](https://cve.now/CVE-2024-29932.md): WordPress WordPress Meta Data and Taxonomies Filter (MDTF) plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-29931](https://cve.now/CVE-2024-29931.md): WordPress WP Go Maps plugin \<= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPGMaps WP Go Maps)
- [CVE-2024-29930](https://cve.now/CVE-2024-29930.md): WordPress Crypto Converter Widget plugin \<= 1.8.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CurrencyRate.today Crypto Converter Widget)
- [CVE-2024-29929](https://cve.now/CVE-2024-29929.md): WordPress WCFM plugin \<= 6.7.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WC Lovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2024-2962](https://cve.now/CVE-2024-2962.md): Networker - Tech News WordPress Theme with Dark Mode \<= 1.1.9 - Missing Authorization (CVSS 5.3, codesupplyco Networker - Tech News WordPress Theme with Dar…)
- [CVE-2024-2466](https://cve.now/CVE-2024-2466.md): TLS certificate check bypass with mbedTLS (CVSS 6.5, curl)
- [CVE-2024-2379](https://cve.now/CVE-2024-2379.md): QUIC certificate check bypass with wolfSSL (CVSS 6.3, curl)
- [CVE-2024-2398](https://cve.now/CVE-2024-2398.md): HTTP/2 push headers memory-leak (CVSS 8.6, curl)
- [CVE-2024-2004](https://cve.now/CVE-2024-2004.md): Usage of disabled protocol (CVSS 3.5, curl)
- [CVE-2024-1023](https://cve.now/CVE-2024-1023.md): Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx (CVSS 6.5, vertx-core · Red Hat CEQ +23)
- [CVE-2024-2956](https://cve.now/CVE-2024-2956.md): Simple Ajax Chat \<= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, specialk Simple Ajax Chat – Add a Fast, Secure Chat Box)
- [CVE-2024-29928](https://cve.now/CVE-2024-29928.md): WordPress Advanced Sermons plugin \<= 3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Codeus Advanced Sermons)
- [CVE-2024-29927](https://cve.now/CVE-2024-29927.md): WordPress WishSuite plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HasTheme WishSuite)
- [CVE-2024-29926](https://cve.now/CVE-2024-29926.md): WordPress WC Builder plugin \<= 1.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HasThemes WC Builder)
- [CVE-2024-29925](https://cve.now/CVE-2024-29925.md): WordPress Post Grid, Slider & Carousel Ultimate plugin \<= 1.6.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpWax Post Grid, Slider & Carousel Ultimate)
- [CVE-2024-29924](https://cve.now/CVE-2024-29924.md): WordPress Premium Packages plugin \<= 5.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, W3 Eden Premium Packages)
- [CVE-2024-29923](https://cve.now/CVE-2024-29923.md): WordPress PropertyHive plugin \<= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PropertyHive)
- [CVE-2024-29922](https://cve.now/CVE-2024-29922.md): WordPress Slider Hero plugin \<= 8.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Quantum Cloud Slider Hero)
- [CVE-2024-29921](https://cve.now/CVE-2024-29921.md): WordPress Photo Gallery by Supsystic plugin \<= 1.15.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Photo Gallery by Supsystic)
- [CVE-2024-29920](https://cve.now/CVE-2024-29920.md): WordPress Move Addons for Elementor plugin \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Moveaddons Move Addons for Elementor)
- [CVE-2024-29919](https://cve.now/CVE-2024-29919.md): WordPress Photo Gallery by Ays Plugin \<=5.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Photo Gallery Team Photo Gallery by Ays)
- [CVE-2024-29918](https://cve.now/CVE-2024-29918.md): WordPress Survey Maker plugin \<= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Survey Maker team Survey Maker)
- [CVE-2024-29917](https://cve.now/CVE-2024-29917.md): WordPress Compact WP Audio Player plugin \<= 1.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Compact WP Audio Player)
- [CVE-2024-29915](https://cve.now/CVE-2024-29915.md): WordPress Podlove Podcast Publisher plugin \<= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Podlove Podcast Publisher)
- [CVE-2024-29914](https://cve.now/CVE-2024-29914.md): WordPress Stratum – Elementor Widgets plugin \<= 1.3.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MotoPress Stratum)
- [CVE-2024-29913](https://cve.now/CVE-2024-29913.md): WordPress Tutor LMS Elementor Addons plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeum Tutor LMS Elementor Addons)
- [CVE-2024-29912](https://cve.now/CVE-2024-29912.md): WordPress iCalendrier plugin \<= 1.80 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Baptiste Placé iCalendrier)
- [CVE-2024-29911](https://cve.now/CVE-2024-29911.md): WordPress Master Addons for Elementor plugin \<= 2.0.5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jewel Theme Master Addons for Elementor)
- [CVE-2024-29910](https://cve.now/CVE-2024-29910.md): WordPress Dropdown Multisite selector plugin \<= 0.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alordiel Dropdown Multisite selector)
- [CVE-2024-29909](https://cve.now/CVE-2024-29909.md): WordPress Travelers' Map plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Camille Verrier Travelers' Map)
- [CVE-2024-29908](https://cve.now/CVE-2024-29908.md): WordPress Co-marquage service-public.fr plugin \<= 0.5.71 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kienso Co-marquage service-public.fr)
- [CVE-2024-29820](https://cve.now/CVE-2024-29820.md): WordPress PDF Builder for WPForms plugin \<= 1.2.88 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RedNao PDF Builder for WPForms)
- [CVE-2024-29906](https://cve.now/CVE-2024-29906.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-29907](https://cve.now/CVE-2024-29907.md): WordPress SEO Backlink Monitor plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Active Websight SEO Backlink Monitor)
- [CVE-2024-30192](https://cve.now/CVE-2024-30192.md): WordPress Pinterest Plugin \<= 1.8.2 - Cross Site Scripting (XSS) (CVSS 6.5, GS Plugins GS Pins for Pinterest)
- [CVE-2024-30193](https://cve.now/CVE-2024-30193.md): WordPress Church Admin plugin \<= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, andy\_moyle Church Admin)
- [CVE-2024-2954](https://cve.now/CVE-2024-2954.md): The Action Network plugin for WordPress is vulnerable to SQL Injection via the 'bulk-action' parameter in version 1.4.3 due to insufficient (CVSS 7.2, jonathankissam Action Network)
- [CVE-2024-1521](https://cve.now/CVE-2024-1521.md): Elementor Website Builder Pro \<= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload (CVSS 6.4, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2024-2120](https://cve.now/CVE-2024-2120.md): Elementor Website Builder Pro \<= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation (CVSS 5.4, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2024-2121](https://cve.now/CVE-2024-2121.md): Elementor Website Builder Pro \<= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2024-2781](https://cve.now/CVE-2024-2781.md): Elementor Website Builder Pro \<= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video\_html\_tag (CVSS 6.4, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2024-1364](https://cve.now/CVE-2024-1364.md): Elementor Website Builder Pro \<= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2024-30194](https://cve.now/CVE-2024-30194.md): WordPress Sunshine Photo Cart plugin \<= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-30195](https://cve.now/CVE-2024-30195.md): WordPress New RoyalSlider plugin \<= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Semenov New RoyalSlider)
- [CVE-2024-30196](https://cve.now/CVE-2024-30196.md): WordPress Easy Social Share Buttons plugin \<= 9.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Appscreo Easy Social Share Buttons)
- [CVE-2024-27188](https://cve.now/CVE-2024-27188.md): WordPress Breeze plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Cloudways Breeze)
- [CVE-2024-30197](https://cve.now/CVE-2024-30197.md): WordPress Church Admin plugin \<= 4.0.26 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, andy\_moyle Church Admin)
- [CVE-2024-30198](https://cve.now/CVE-2024-30198.md): WordPress Buddyforms plugin \<= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 5.8, ThemeKraft BuddyForms)
- [CVE-2024-30201](https://cve.now/CVE-2024-30201.md): WordPress WP Smart Import plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Xylus Themes WordPress Importer)
- [CVE-2024-30199](https://cve.now/CVE-2024-30199.md): WordPress WP-Lister Lite for Amazon plugin \<= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Lab WP-Lister Lite for Amazon)
- [CVE-2024-22299](https://cve.now/CVE-2024-22299.md): WordPress FV Player plugin \<= 7.5.41.7212 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Foliovision: Making the web work for you FV Flowplayer Vide…)
- [CVE-2024-22300](https://cve.now/CVE-2024-22300.md): WordPress Icegram Express plugin \<= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Icegram Email Subscribers & Newsletters)
- [CVE-2023-52228](https://cve.now/CVE-2023-52228.md): WordPress Beds24 Online Booking plugin \<= 2.0.24 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mark Kinchin Beds24 Online Booking)
- [CVE-2024-22149](https://cve.now/CVE-2024-22149.md): WordPress cformsII plugin \<= 15.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Oliver Seidel, Bastian Germann CformsII)
- [CVE-2024-22288](https://cve.now/CVE-2024-22288.md): WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin \<= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2024-24700](https://cve.now/CVE-2024-24700.md): WordPress WP Editor plugin \<= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Benjamin Rojas WP Editor)
- [CVE-2024-24800](https://cve.now/CVE-2024-24800.md): WordPress Product Feed PRO for WooCommerce plugin \<= 13.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AdTribes.io Product Feed PRO for WooCommerce)
- [CVE-2024-25920](https://cve.now/CVE-2024-25920.md): WordPress WP SMS plugin \<= 6.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VeronaLabs WP SMS)
- [CVE-2024-25926](https://cve.now/CVE-2024-25926.md): WordPress Widgets Controller plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IndiaNIC Widgets Controller)
- [CVE-2023-39306](https://cve.now/CVE-2023-39306.md): WordPress Avada Builder plugin \<= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeFusion Fusion Builder)
- [CVE-2024-22311](https://cve.now/CVE-2024-22311.md): WordPress Simply Schedule Appointments plugin \<= 1.6.6.20 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, N Squared Simply Schedule Appointments)
- [CVE-2024-24842](https://cve.now/CVE-2024-24842.md): WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin \<= 11.30.2 - PHP Object Injection vulnerability (CVSS 8.7, Echo Plugins Knowledge Base for Documentation, FAQs with AI…)
- [CVE-2023-49815](https://cve.now/CVE-2023-49815.md): WordPress WappPress plugin \<= 5.0.3 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, WappPress Team WappPress)
- [CVE-2024-2945](https://cve.now/CVE-2024-2945.md): Campcodes Online Examination System updateExaminee.php sql injection (CVSS 6.3, Campcodes Online Examination System)
- [CVE-2024-2944](https://cve.now/CVE-2024-2944.md): Campcodes Online Examination System deleteCourseExe.php sql injection (CVSS 6.3, Campcodes Online Examination System)
- [CVE-2024-2943](https://cve.now/CVE-2024-2943.md): Campcodes Online Examination System deleteExamExe.php sql injection (CVSS 6.3, Campcodes Online Examination System)
- [CVE-2024-2097](https://cve.now/CVE-2024-2097.md): An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control (CVSS 7.5, Hitachi Energy MACH SCM Server · Hitachi Energy MACH SCM To…)
- [CVE-2024-0400](https://cve.now/CVE-2024-0400.md): SCM Software is a client and server application. (CVSS 7.5, Hitachi Energy MACH SCM)
- [CVE-2024-2942](https://cve.now/CVE-2024-2942.md): Campcodes Online Examination System deleteQuestionExe.php sql injection (CVSS 6.3, Campcodes Online Examination System)
- [CVE-2024-2941](https://cve.now/CVE-2024-2941.md): Campcodes Online Examination System loginExe.php sql injection (CVSS 6.3, Campcodes Online Examination System)
- [CVE-2024-2203](https://cve.now/CVE-2024-2203.md): The Plus Addons for Elementor \<= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-2139](https://cve.now/CVE-2024-2139.md): Master Addons for Elementor \<= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-2210](https://cve.now/CVE-2024-2210.md): The Plus Addons for Elementor \<= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-1532](https://cve.now/CVE-2024-1532.md): A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. (CVSS 6.8, Hitachi Energy RTU500 series CMU firmware)
- [CVE-2024-1531](https://cve.now/CVE-2024-1531.md): A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. (CVSS 8.2, Hitachi Energy RTU500 series CMU firmware)
- [CVE-2024-2940](https://cve.now/CVE-2024-2940.md): Campcodes Online Examination System updateCourse.php cross site scripting (CVSS 3.5, Campcodes Online Examination System)
- [CVE-2024-2244](https://cve.now/CVE-2024-2244.md): REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successfu (CVSS 5.3, Hitachi Energy Asset Suite EAM)
- [CVE-2024-2939](https://cve.now/CVE-2024-2939.md): Campcodes Online Examination System updateExaminee.php cross site scripting (CVSS 3.5, Campcodes Online Examination System)
- [CVE-2024-2938](https://cve.now/CVE-2024-2938.md): Campcodes Online Examination System updateCourse.php sql injection (CVSS 6.3, Campcodes Online Examination System)
- [CVE-2024-2935](https://cve.now/CVE-2024-2935.md): SourceCodester Todo List in Kanban Board Add ToDo cross site scripting (CVSS 5.3, SourceCodester Todo List in Kanban Board)
- [CVE-2024-2934](https://cve.now/CVE-2024-2934.md): SourceCodester Todo List in Kanban Board delete-todo.php sql injection (CVSS 6.3, SourceCodester Todo List in Kanban Board)
- [CVE-2024-2206](https://cve.now/CVE-2024-2206.md): SSRF Vulnerability in gradio-app/gradio (CVSS 7.3, gradio-app/gradio · gradio)
- [CVE-2024-2932](https://cve.now/CVE-2024-2932.md): SourceCodester Online Chatting System update\_room.php sql injection (CVSS 6.3, SourceCodester Online Chatting System)
- [CVE-2023-25364](https://cve.now/CVE-2023-25364.md): Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks. (CVSS 6.1)
- [CVE-2023-29134](https://cve.now/CVE-2023-29134.md): An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. (CVSS 8.6)
- [CVE-2023-31634](https://cve.now/CVE-2023-31634.md): In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. (CVSS 9.8)
- [CVE-2023-31854](https://cve.now/CVE-2023-31854.md): std::bad\_alloc is mishandled in Precomp 0.4.8. (no CVSS)
- [CVE-2023-39804](https://cve.now/CVE-2023-39804.md): In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. (CVSS 6.2)
- [CVE-2023-40284](https://cve.now/CVE-2023-40284.md): An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. (CVSS 8.3)
- [CVE-2023-40285](https://cve.now/CVE-2023-40285.md): An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. (CVSS 6.5)
- [CVE-2023-40286](https://cve.now/CVE-2023-40286.md): An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. (CVSS 8.3)
- [CVE-2023-40287](https://cve.now/CVE-2023-40287.md): An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. (CVSS 8.3)
- [CVE-2023-40288](https://cve.now/CVE-2023-40288.md): An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. (CVSS 8.3)
- [CVE-2023-40289](https://cve.now/CVE-2023-40289.md): A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. (CVSS 7.2)
- [CVE-2023-40290](https://cve.now/CVE-2023-40290.md): An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. (CVSS 8.3)
- [CVE-2023-43768](https://cve.now/CVE-2023-43768.md): An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. (CVSS 7.5)
- [CVE-2023-45913](https://cve.now/CVE-2023-45913.md): Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). (CVSS 6.2)
- [CVE-2023-45919](https://cve.now/CVE-2023-45919.md): Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). (CVSS 5.3)
- [CVE-2023-45920](https://cve.now/CVE-2023-45920.md): Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). (CVSS 4.2)
- [CVE-2023-45922](https://cve.now/CVE-2023-45922.md): glx\_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling \_\_glXGetDrawableAttribute(). (CVSS 4.3)
- [CVE-2023-45924](https://cve.now/CVE-2023-45924.md): libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). (CVSS 9.8)
- [CVE-2023-45925](https://cve.now/CVE-2023-45925.md): GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x\_error\_handler() at tty/ (no CVSS)
- [CVE-2023-45927](https://cve.now/CVE-2023-45927.md): S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt\_sprintf(). (CVSS 9.1)
- [CVE-2023-45929](https://cve.now/CVE-2023-45929.md): S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup\_tgetstr(). (CVSS 9.1)
- [CVE-2023-45931](https://cve.now/CVE-2023-45931.md): Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check\_xshm() for the has\_error state. (CVSS 7.5)
- [CVE-2023-45935](https://cve.now/CVE-2023-45935.md): Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). (CVSS 4.2)
- [CVE-2023-46046](https://cve.now/CVE-2023-46046.md): An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti\_expr in a crafted .mzn file. (CVSS 5.5)
- [CVE-2023-46047](https://cve.now/CVE-2023-46047.md): An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei\_configure\_attach() function. (CVSS 7.3)
- [CVE-2023-46048](https://cve.now/CVE-2023-46048.md): Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. (CVSS 6.2)
- [CVE-2023-46049](https://cve.now/CVE-2023-46049.md): LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) (CVSS 5.3)
- [CVE-2023-46051](https://cve.now/CVE-2023-46051.md): TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. (CVSS 3.3)
- [CVE-2023-46052](https://cve.now/CVE-2023-46052.md): Sane 1.2.1 heap bounds overwrite in init\_options() from backend/test.c via a long init\_mode string in a configuration file. (no CVSS)
- [CVE-2023-47438](https://cve.now/CVE-2023-47438.md): SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the pro (CVSS 6.5, reportico-web/reportico)
- [CVE-2024-24334](https://cve.now/CVE-2024-24334.md): A heap buffer overflow occurs in dfs\_v2 dfs\_file in RT-Thread through 5.0.2. (CVSS 8.4)
- [CVE-2024-24335](https://cve.now/CVE-2024-24335.md): A heap buffer overflow occurs in the dfs\_v2 romfs filesystem RT-Thread through 5.0.2. (CVSS 8.4)
- [CVE-2024-25354](https://cve.now/CVE-2024-25354.md): RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function. (CVSS 7.5, domain-suffix)
- [CVE-2024-25388](https://cve.now/CVE-2024-25388.md): drivers/wlan/wlan\_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow. (CVSS 8.4)
- [CVE-2024-25389](https://cve.now/CVE-2024-25389.md): RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L \* seed + 2531011L; return (seed \>\> 16) & 0x7FFF;" (CVSS 7.5)
- [CVE-2024-25390](https://cve.now/CVE-2024-25390.md): A heap buffer overflow occurs in finsh/msh\_file.c and finsh/msh.c in RT-Thread through 5.0.2. (CVSS 8.4)
- [CVE-2024-25391](https://cve.now/CVE-2024-25391.md): A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. (CVSS 8.4)
- [CVE-2024-25392](https://cve.now/CVE-2024-25392.md): An out-of-bounds access occurs in utilities/var\_export/var\_export.c in RT-Thread through 5.0.2. (CVSS 5.9)
- [CVE-2024-25393](https://cve.now/CVE-2024-25393.md): A stack buffer overflow occurs in net/at/src/at\_server.c in RT-Thread through 5.0.2. (CVSS 9.8)
- [CVE-2024-25394](https://cve.now/CVE-2024-25394.md): A buffer overflow occurs in utilities/ymodem/ry\_sy.c in RT-Thread through 5.0.2 because of an incorrect sprintf call or a missing '\\0' chara (CVSS 4.3)
- [CVE-2024-25395](https://cve.now/CVE-2024-25395.md): A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. (CVSS 8.8)
- [CVE-2024-25580](https://cve.now/CVE-2024-25580.md): An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x bef (CVSS 6.2)
- [CVE-2024-25734](https://cve.now/CVE-2024-25734.md): An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. (CVSS 7.5)
- [CVE-2024-25735](https://cve.now/CVE-2024-25735.md): An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. (CVSS 9.1)
- [CVE-2024-25736](https://cve.now/CVE-2024-25736.md): An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. (CVSS 7.5)
- [CVE-2024-28085](https://cve.now/CVE-2024-28085.md): wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals t (CVSS 3.3)
- [CVE-2024-28335](https://cve.now/CVE-2024-28335.md): Lektor before 3.3.11 does not sanitize DB path traversal. (CVSS 9.1, lektor)
- [CVE-2024-28815](https://cve.now/CVE-2024-28815.md): A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive i (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.