# CVEs published 2024-04-06 39 CVEs were published on April 6, 2024: 1 critical, 15 high. Days are UTC. - [CVE-2024-3415](https://cve.now/CVE-2024-3415.md): SourceCodester Human Resource Information System addbranches\_process.php cross site scripting (CVSS 3.5, SourceCodester Human Resource Information System) - [CVE-2024-3414](https://cve.now/CVE-2024-3414.md): SourceCodester Human Resource Information System addcorporate\_process.php cross site scripting (CVSS 3.5, SourceCodester Human Resource Information System) - [CVE-2024-3413](https://cve.now/CVE-2024-3413.md): SourceCodester Human Resource Information System login\_process.php sql injection (CVSS 7.3, SourceCodester Human Resource Information System) - [CVE-2024-0406](https://cve.now/CVE-2024-0406.md): Mholt/archiver: path traversal vulnerability (CVSS 6.1, archiver · Red Hat OpenShift Container Platform +3) - [CVE-2024-3159](https://cve.now/CVE-2024-3159.md): Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a c (CVSS 8.8, Google Chrome) - [CVE-2024-3158](https://cve.now/CVE-2024-3158.md): Use after free in Bookmarks in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome) - [CVE-2024-3156](https://cve.now/CVE-2024-3156.md): Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds m (CVSS 8.8, Google Chrome) - [CVE-2024-3378](https://cve.now/CVE-2024-3378.md): iboss Secure Web Gateway Login Portal login cross site scripting (CVSS 4.3, iboss Secure Web Gateway) - [CVE-2024-3377](https://cve.now/CVE-2024-3377.md): SourceCodester Computer Laboratory Management System cross site scripting (CVSS 4.3, SourceCodester Computer Laboratory Management System) - [CVE-2024-24746](https://cve.now/CVE-2024-24746.md): Apache NimBLE: Denial of service in NimBLE Bluetooth stack (CVSS 7.5, Apache Software Foundation Apache NimBLE) - [CVE-2024-25029](https://cve.now/CVE-2024-25029.md): IBM Personal Communications code execution (CVSS 9.0, IBM Personal Communications) - [CVE-2024-22328](https://cve.now/CVE-2024-22328.md): IBM Maximo Application Suite information disclosure (CVSS 7.5, IBM Maximo Application Suite) - [CVE-2024-3376](https://cve.now/CVE-2024-3376.md): SourceCodester Computer Laboratory Management System config.php redirect (CVSS 7.3, SourceCodester Computer Laboratory Management System) - [CVE-2024-3369](https://cve.now/CVE-2024-3369.md): code-projects Car Rental add-vehicle.php unrestricted upload (CVSS 6.3, code-projects Car Rental) - [CVE-2024-3366](https://cve.now/CVE-2024-3366.md): Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection (CVSS 3.5, Xuxueli xxl-job · com.xuxueli:xxl-job-core) - [CVE-2024-3365](https://cve.now/CVE-2024-3365.md): SourceCodester Online Library System controller.php cross site scripting (CVSS 3.5, SourceCodester Online Library System) - [CVE-2024-3364](https://cve.now/CVE-2024-3364.md): SourceCodester Online Library System index.php cross site scripting (CVSS 3.5, SourceCodester Online Library System) - [CVE-2024-2296](https://cve.now/CVE-2024-2296.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG (CVSS 5.5, Photo Gallery by 10Web – Mobile-Friendly Image Gallery) - [CVE-2024-2132](https://cve.now/CVE-2024-2132.md): Ultimate Bootstrap Elements for Elementor \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget (CVSS 6.4, g5theme Ultimate Bootstrap Elements for Elementor) - [CVE-2024-3363](https://cve.now/CVE-2024-3363.md): SourceCodester Online Library System index.php sql injection (CVSS 7.3, SourceCodester Online Library System) - [CVE-2024-2458](https://cve.now/CVE-2024-2458.md): Powerkit – Supercharge your WordPress Site \<= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, codesupplyco Powerkit – Supercharge your WordPress Site) - [CVE-2024-0837](https://cve.now/CVE-2024-0837.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…) - [CVE-2024-1428](https://cve.now/CVE-2024-1428.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…) - [CVE-2024-2949](https://cve.now/CVE-2024-2949.md): Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp\_wp\_carousel\_shortcode' (CVSS 6.4, shapedplugin Carousel, Slider, Photo Gallery with Lightbox,…) - [CVE-2024-3362](https://cve.now/CVE-2024-3362.md): SourceCodester Online Library System controller.php sql injection (CVSS 7.3, SourceCodester Online Library System) - [CVE-2024-2471](https://cve.now/CVE-2024-2471.md): FooGallery \<= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields (CVSS 6.4, fooplugins Gallery by FooGallery) - [CVE-2024-3361](https://cve.now/CVE-2024-3361.md): SourceCodester Online Library System deweydecimal.php sql injection (CVSS 7.3, SourceCodester Online Library System) - [CVE-2024-2444](https://cve.now/CVE-2024-2444.md): Inline Related Posts \< 3.5.0 - Admin+ Stored XSS (CVSS 4.8, Inline Related Posts) - [CVE-2024-3360](https://cve.now/CVE-2024-3360.md): SourceCodester Online Library System index.php sql injection (CVSS 7.3, SourceCodester Online Library System) - [CVE-2024-3359](https://cve.now/CVE-2024-3359.md): SourceCodester Online Library System login.php sql injection (CVSS 7.3, SourceCodester Online Library System) - [CVE-2024-3358](https://cve.now/CVE-2024-3358.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php cross site scripting (CVSS 3.5, SourceCodester Aplaya Beach Resort Online Reservation System) - [CVE-2024-2950](https://cve.now/CVE-2024-2950.md): BoldGrid Easy SEO – Simple and Effective SEO \<= 1.6.14 - Information Exposure (CVSS 5.3, BoldGrid Easy SEO – Simple and Effective SEO) - [CVE-2024-3216](https://cve.now/CVE-2024-3216.md): WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \<= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset (CVSS 5.3, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…) - [CVE-2024-1385](https://cve.now/CVE-2024-1385.md): WP-Stateless – Google Cloud Storage \<= 3.4.0 - Missing Authorization to Limited Arbitrary Options Update (CVSS 7.1, usability\_dynamics WP-Stateless – Google Cloud Storage) - [CVE-2024-2656](https://cve.now/CVE-2024-2656.md): Icegram Express \<= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import (CVSS 4.4, icegram Email Subscribers & Newsletters – Email Marketing,…) - [CVE-2024-3245](https://cve.now/CVE-2024-3245.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…) - [CVE-2024-1994](https://cve.now/CVE-2024-1994.md): Image Watermark \<= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification (CVSS 4.3, dfactory Image Watermark) - [CVE-2024-27620](https://cve.now/CVE-2024-27620.md): An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API. (CVSS 7.5) - [CVE-2024-28741](https://cve.now/CVE-2024-28741.md): Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php co (CVSS 8.8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-04-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.