# CVEs published 2024-04-07

62 CVEs were published on April 7, 2024: 4 critical, 19 high. Days are UTC.

- [CVE-2024-3436](https://cve.now/CVE-2024-3436.md): SourceCodester Prison Management System Avatar edit-photo.php unrestricted upload (CVSS 6.3, SourceCodester Prison Management System)
- [CVE-2024-3434](https://cve.now/CVE-2024-3434.md): CP Plus Wi-Fi Camera User Management improper authorization (CVSS 5.4, CP Plus Wi-Fi Camera)
- [CVE-2024-3433](https://cve.now/CVE-2024-3433.md): PuneethReddyHC Event Management register.php cross site scripting (CVSS 3.5, PuneethReddyHC Event Management)
- [CVE-2024-3432](https://cve.now/CVE-2024-3432.md): PuneethReddyHC Event Management register.php sql injection (CVSS 5.5, PuneethReddyHC Event Management)
- [CVE-2024-3431](https://cve.now/CVE-2024-3431.md): EyouCMS Backend deserialization (CVSS 4.7, EyouCMS)
- [CVE-2024-3430](https://cve.now/CVE-2024-3430.md): QKSMS Backup File androidmanifest.xml backup (CVSS 2.4, QKSMS)
- [CVE-2024-31291](https://cve.now/CVE-2024-31291.md): WordPress ProfileGrid plugin \<= 5.7.6 - IDOR on Friend Request vulnerability (CVSS 4.3, Metagauss ProfileGrid)
- [CVE-2024-31296](https://cve.now/CVE-2024-31296.md): WordPress BookingPress plugin \<= 1.0.81 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Repute Infosystems BookingPress)
- [CVE-2024-31233](https://cve.now/CVE-2024-31233.md): WordPress Rehub theme \<= 19.6.1 - Auth. SQL Injection vulnerability (CVSS 8.5, Sizam Rehub)
- [CVE-2024-31234](https://cve.now/CVE-2024-31234.md): WordPress REHub Framework plugin \< 19.6.2 - SQL Injection vulnerability (CVSS 8.5, Sizam REHub Framework)
- [CVE-2024-31241](https://cve.now/CVE-2024-31241.md): WordPress LearnPress Export Import plugin \<= 4.0.3 - Auth. SQL Injection vulnerability (CVSS 7.6, ThimPress LearnPress Export Import)
- [CVE-2024-31260](https://cve.now/CVE-2024-31260.md): WordPress Edwiser Bridge plugin \<= 3.0.2 - SQL Injection vulnerability (CVSS 7.6, WisdmLabs Edwiser Bridge)
- [CVE-2024-22155](https://cve.now/CVE-2024-22155.md): WordPress WooCommerce plugin \<= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Automattic WooCommerce)
- [CVE-2024-31236](https://cve.now/CVE-2024-31236.md): WordPress Royal Elementor Addons plugin \<= 1.3.93 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Royal Royal Elementor Addons)
- [CVE-2024-31255](https://cve.now/CVE-2024-31255.md): WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin \<= 2.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts)
- [CVE-2024-31256](https://cve.now/CVE-2024-31256.md): WordPress WebinarPress plugin \<= 1.33.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WebinarPress)
- [CVE-2024-31257](https://cve.now/CVE-2024-31257.md): WordPress Formsite plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Formsite | Embed online forms to collect orders, registrati…)
- [CVE-2024-31258](https://cve.now/CVE-2024-31258.md): WordPress Form to Chat App plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Micro.company Form to Chat App)
- [CVE-2024-31306](https://cve.now/CVE-2024-31306.md): WordPress Essential Blocks plugin \<= 4.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Essential Blocks for Gutenberg)
- [CVE-2024-31344](https://cve.now/CVE-2024-31344.md): WordPress Easy Login Styler plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Phpbits Creative Studio Easy Login Styler – White Label Adm…)
- [CVE-2024-31346](https://cve.now/CVE-2024-31346.md): WordPress Gradient Text Widget for Elementor plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Blocksmarket Gradient Text Widget for Elementor)
- [CVE-2024-31348](https://cve.now/CVE-2024-31348.md): WordPress Super Testimonials plugin \<= 3.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themepoints Testimonials)
- [CVE-2024-31349](https://cve.now/CVE-2024-31349.md): WordPress MailMunch – Grow your Email List plugin \<= 3.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MailMunch – Grow your Email List)
- [CVE-2024-31280](https://cve.now/CVE-2024-31280.md): WordPress Church Admin plugin \<= 4.1.5 - Arbitrary File Upload vulnerability (CVSS 9.9, andy\_moyle Church Admin)
- [CVE-2024-3428](https://cve.now/CVE-2024-3428.md): SourceCodester Online Courseware edit.php cross site scripting (CVSS 3.5, SourceCodester Online Courseware)
- [CVE-2024-31286](https://cve.now/CVE-2024-31286.md): WordPress WP Photo Album Plus plugin \< 8.6.03.005 - Arbitrary File Upload vulnerability (CVSS 9.9, J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus)
- [CVE-2024-31292](https://cve.now/CVE-2024-31292.md): WordPress Import XML and RSS Feeds plugin \<= 2.1.5 - Arbitrary File Upload vulnerability (CVSS 7.2, Moove Agency Import XML and RSS Feeds)
- [CVE-2024-31345](https://cve.now/CVE-2024-31345.md): WordPress Auto Poster plugin \<= 1.2 - Arbitrary File Upload vulnerability (CVSS 9.1, Sukhchain Singh Auto Poster)
- [CVE-2024-31277](https://cve.now/CVE-2024-31277.md): WordPress Product Designer plugin \<= 1.0.32 - PHP Object Injection vulnerability (CVSS 8.7, PickPlugins Product Designer)
- [CVE-2024-31308](https://cve.now/CVE-2024-31308.md): WordPress WP Import Export Lite & WP Import Export plugin \<= 3.9.26 - PHP Object Injection vulnerability (CVSS 4.4, VJInfotech WP Import Export Lite)
- [CVE-2024-31288](https://cve.now/CVE-2024-31288.md): WordPress RapidLoad plugin \<= 2.2.11 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, RapidLoad Power-Up for Autoptimize)
- [CVE-2024-3427](https://cve.now/CVE-2024-3427.md): SourceCodester Online Courseware addq.php cross site scripting (CVSS 3.5, SourceCodester Online Courseware)
- [CVE-2024-3426](https://cve.now/CVE-2024-3426.md): SourceCodester Online Courseware editt.php cross site scripting (CVSS 3.5, SourceCodester Online Courseware)
- [CVE-2024-3425](https://cve.now/CVE-2024-3425.md): SourceCodester Online Courseware activateall.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3424](https://cve.now/CVE-2024-3424.md): SourceCodester Online Courseware listscore.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3423](https://cve.now/CVE-2024-3423.md): SourceCodester Online Courseware activateteach.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3422](https://cve.now/CVE-2024-3422.md): SourceCodester Online Courseware activatestud.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3421](https://cve.now/CVE-2024-3421.md): SourceCodester Online Courseware deactivatestud.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3420](https://cve.now/CVE-2024-3420.md): SourceCodester Online Courseware saveedit.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3419](https://cve.now/CVE-2024-3419.md): SourceCodester Online Courseware edit.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3418](https://cve.now/CVE-2024-3418.md): SourceCodester Online Courseware deactivateteach.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2023-52717](https://cve.now/CVE-2023-52717.md): Permission verification vulnerability in the lock screen module. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52716](https://cve.now/CVE-2023-52716.md): Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52715](https://cve.now/CVE-2023-52715.md): The SystemUI module has a vulnerability in permission management. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2021-4438](https://cve.now/CVE-2021-4438.md): kyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application components (CVSS 5.3, kyivstarteam react-native-sms-user-consent · @kyivstarteam/…)
- [CVE-2023-52714](https://cve.now/CVE-2023-52714.md): Vulnerability of defects introduced in the design process in the hwnff module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52713](https://cve.now/CVE-2023-52713.md): Vulnerability of improper permission control in the window management module. (CVSS 7.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-30418](https://cve.now/CVE-2024-30418.md): Vulnerability of insufficient permission verification in the app management module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-30417](https://cve.now/CVE-2024-30417.md): Path traversal vulnerability in the Bluetooth-based sharing module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-30416](https://cve.now/CVE-2024-30416.md): Use After Free (UAF) vulnerability in the underlying driver module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-30415](https://cve.now/CVE-2024-30415.md): Vulnerability of improper permission control in the window management module. (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-30414](https://cve.now/CVE-2024-30414.md): Command injection vulnerability in the AccountManager module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-30413](https://cve.now/CVE-2024-30413.md): Vulnerability of improper permission control in the window management module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-3417](https://cve.now/CVE-2024-3417.md): SourceCodester Online Courseware saveeditt.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2024-3416](https://cve.now/CVE-2024-3416.md): SourceCodester Online Courseware editt.php sql injection (CVSS 6.3, SourceCodester Online Courseware)
- [CVE-2023-6877](https://cve.now/CVE-2023-6877.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message (CVSS 6.4, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2020-36829](https://cve.now/CVE-2020-36829.md): The Mojolicious module before 8.65 for Perl is vulnerable to secure\_compare timing attacks that allow an attacker to guess the length of a s (CVSS 7.5)
- [CVE-2021-47208](https://cve.now/CVE-2021-47208.md): The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service. (CVSS 4.3)
- [CVE-2024-31948](https://cve.now/CVE-2024-31948.md): In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash (CVSS 6.5)
- [CVE-2024-31949](https://cve.now/CVE-2024-31949.md): In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data (CVSS 6.5)
- [CVE-2024-31950](https://cve.now/CVE-2024-31950.md): In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf\_te\_parse\_ri for OSPF LSA packets during an attempt t (CVSS 6.5)
- [CVE-2024-31951](https://cve.now/CVE-2024-31951.md): In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf\_te\_parse\_ext\_ (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.