# CVEs published 2024-04-13

16 CVEs were published on April 13, 2024: 0 critical, 2 high. Days are UTC.

- [CVE-2024-3740](https://cve.now/CVE-2024-3740.md): cym1102 nginxWebUI reload exec deserialization (CVSS 6.3, cym1102 nginxWebUI)
- [CVE-2024-3739](https://cve.now/CVE-2024-3739.md): cym1102 nginxWebUI upload os command injection (CVSS 6.3, cym1102 nginxWebUI)
- [CVE-2024-3738](https://cve.now/CVE-2024-3738.md): cym1102 nginxWebUI saveCmd handlePath certificate validation (CVSS 7.3, cym1102 nginxWebUI)
- [CVE-2024-3737](https://cve.now/CVE-2024-3737.md): cym1102 nginxWebUI addOver findCountByQuery path traversal (CVSS 6.3, cym1102 nginxWebUI)
- [CVE-2024-3736](https://cve.now/CVE-2024-3736.md): cym1102 nginxWebUI upload unrestricted upload (CVSS 4.3, cym1102 nginxWebUI)
- [CVE-2024-3735](https://cve.now/CVE-2024-3735.md): Smart Office Main.aspx weak password (CVSS 6.3, Smart Office)
- [CVE-2024-3721](https://cve.now/CVE-2024-3721.md): TBK DVR-4104/DVR-4216 os command injection (CVSS 6.3, TBK DVR-4104 · TBK DVR-4216)
- [CVE-2024-3720](https://cve.now/CVE-2024-3720.md): Tianwell Fire Intelligent Command Platform API Interface page sql injection (CVSS 6.3, Tianwell Fire Intelligent Command Platform)
- [CVE-2024-26817](https://cve.now/CVE-2024-26817.md): amdkfd: use calloc instead of kzalloc to avoid integer overflow (no CVSS, Linux)
- [CVE-2024-3719](https://cve.now/CVE-2024-3719.md): Campcodes House Rental Management System ajax.php sql injection (CVSS 6.3, Campcodes House Rental Management System)
- [CVE-2024-3662](https://cve.now/CVE-2024-3662.md): WPZOOM Social Feed Widget & Block \<= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion (CVSS 4.3, WPZOOM Social Feed Widget & Block)
- [CVE-2023-6494](https://cve.now/CVE-2023-6494.md): WPC Smart Quick View for WooCommerce \<= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, wpclever WPC Smart Quick View for WooCommerce)
- [CVE-2024-2583](https://cve.now/CVE-2024-2583.md): Shortcodes Ultimate \< 7.0.5 - Contributor+ Stored XSS (CVSS 5.4, WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-3027](https://cve.now/CVE-2024-3027.md): Smart Slider 3 \<= 3.5.1.22 - Missing Authorization to Limited File Upload (CVSS 6.4, nextendweb Smart Slider)
- [CVE-2024-1957](https://cve.now/CVE-2024-1957.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-32487](https://cve.now/CVE-2024-32487.md): less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. (CVSS 8.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.