CVEs published April 7, 2024
62 CVEs were published on April 7, 2024: 4 critical, 19 high.
- Published
- 62
- Critical
- 4
- High
- 19
- Medium
- 34
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- SourceCodester Online Courseware
- 13
- Huawei HarmonyOS · Huawei EMUI
- 10
- PuneethReddyHC Event Management
- 2
- andy_moyle Church Admin
- 1
- Automattic WooCommerce
- 1
- Blocksmarket Gradient Text Widget for Elementor
- 1
- CP Plus Wi-Fi Camera
- 1
- ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts
- 1
- EyouCMS
- 1
- Formsite | Embed online forms to collect orders, registrati…
- 1
Critical 4
- CVE-2024-31280WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerabilityandy_moyle Church Admin
- CVE-2024-31286WordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerabilityJ.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
- CVE-2024-31345WordPress Auto Poster plugin <= 1.2 - Arbitrary File Upload vulnerabilitySukhchain Singh Auto Poster
- CVE-2024-30415Vulnerability of improper permission control in the window management module.Huawei HarmonyOS · Huawei EMUI
High 19
- CVE-2024-31233WordPress Rehub theme <= 19.6.1 - Auth. SQL Injection vulnerabilitySizam Rehub
- CVE-2024-31234WordPress REHub Framework plugin < 19.6.2 - SQL Injection vulnerabilitySizam REHub Framework
- CVE-2024-31241WordPress LearnPress Export Import plugin <= 4.0.3 - Auth. SQL Injection vulnerabilityThimPress LearnPress Export Import
- CVE-2024-31260WordPress Edwiser Bridge plugin <= 3.0.2 - SQL Injection vulnerabilityWisdmLabs Edwiser Bridge
- CVE-2024-31255WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts
- CVE-2024-31256WordPress WebinarPress plugin <= 1.33.10 - Reflected Cross Site Scripting (XSS) vulnerabilityWebinarPress
- CVE-2024-31292WordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerabilityMoove Agency Import XML and RSS Feeds
- CVE-2024-31277WordPress Product Designer plugin <= 1.0.32 - PHP Object Injection vulnerabilityPickPlugins Product Designer
- CVE-2024-31288WordPress RapidLoad plugin <= 2.2.11 - Server Side Request Forgery (SSRF) vulnerabilityRapidLoad Power-Up for Autoptimize
- CVE-2023-52716Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52715The SystemUI module has a vulnerability in permission management.Huawei HarmonyOS
- CVE-2023-52714Vulnerability of defects introduced in the design process in the hwnff module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52713Vulnerability of improper permission control in the window management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-30418Vulnerability of insufficient permission verification in the app management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-30417Path traversal vulnerability in the Bluetooth-based sharing module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-30416Use After Free (UAF) vulnerability in the underlying driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-30414Command injection vulnerability in the AccountManager module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-30413Vulnerability of improper permission control in the window management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2020-36829The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a s
Medium, low and unrated 39
- CVE-2024-3436SourceCodester Prison Management System Avatar edit-photo.php unrestricted uploadSourceCodester Prison Management System
- CVE-2024-3434CP Plus Wi-Fi Camera User Management improper authorizationCP Plus Wi-Fi Camera
- CVE-2024-3433PuneethReddyHC Event Management register.php cross site scriptingPuneethReddyHC Event Management
- CVE-2024-3432PuneethReddyHC Event Management register.php sql injectionPuneethReddyHC Event Management
- CVE-2024-3431EyouCMS Backend deserializationEyouCMS
- CVE-2024-3430QKSMS Backup File androidmanifest.xml backupQKSMS
- CVE-2024-31291WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerabilityMetagauss ProfileGrid
- CVE-2024-31296WordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerabilityRepute Infosystems BookingPress
- CVE-2024-22155WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic WooCommerce
- CVE-2024-31236WordPress Royal Elementor Addons plugin <= 1.3.93 - Cross Site Scripting (XSS) vulnerabilityWP Royal Royal Elementor Addons
- CVE-2024-31257WordPress Formsite plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityFormsite | Embed online forms to collect orders, registrati…
- CVE-2024-31258WordPress Form to Chat App plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityMicro.company Form to Chat App
- CVE-2024-31306WordPress Essential Blocks plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Essential Blocks for Gutenberg
- CVE-2024-31344WordPress Easy Login Styler plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityPhpbits Creative Studio Easy Login Styler – White Label Adm…
- CVE-2024-31346WordPress Gradient Text Widget for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityBlocksmarket Gradient Text Widget for Elementor
- CVE-2024-31348WordPress Super Testimonials plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityThemepoints Testimonials
- CVE-2024-31349WordPress MailMunch – Grow your Email List plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerabilityMailMunch – Grow your Email List
- CVE-2024-3428SourceCodester Online Courseware edit.php cross site scriptingSourceCodester Online Courseware
- CVE-2024-31308WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerabilityVJInfotech WP Import Export Lite
- CVE-2024-3427SourceCodester Online Courseware addq.php cross site scriptingSourceCodester Online Courseware
- CVE-2024-3426SourceCodester Online Courseware editt.php cross site scriptingSourceCodester Online Courseware
- CVE-2024-3425SourceCodester Online Courseware activateall.php sql injectionSourceCodester Online Courseware
- CVE-2024-3424SourceCodester Online Courseware listscore.php sql injectionSourceCodester Online Courseware
- CVE-2024-3423SourceCodester Online Courseware activateteach.php sql injectionSourceCodester Online Courseware
- CVE-2024-3422SourceCodester Online Courseware activatestud.php sql injectionSourceCodester Online Courseware
- CVE-2024-3421SourceCodester Online Courseware deactivatestud.php sql injectionSourceCodester Online Courseware
- CVE-2024-3420SourceCodester Online Courseware saveedit.php sql injectionSourceCodester Online Courseware
- CVE-2024-3419SourceCodester Online Courseware edit.php sql injectionSourceCodester Online Courseware
- CVE-2024-3418SourceCodester Online Courseware deactivateteach.php sql injectionSourceCodester Online Courseware
- CVE-2023-52717Permission verification vulnerability in the lock screen module.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-4438kyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application componentskyivstarteam react-native-sms-user-consent · @kyivstarteam/…
- CVE-2024-3417SourceCodester Online Courseware saveeditt.php sql injectionSourceCodester Online Courseware
- CVE-2024-3416SourceCodester Online Courseware editt.php sql injectionSourceCodester Online Courseware
- CVE-2023-6877RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Messagethemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2021-47208The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- CVE-2024-31948In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash
- CVE-2024-31949In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data
- CVE-2024-31950In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt t
- CVE-2024-31951In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_