# CVEs published 2024-04-27

27 CVEs were published on April 27, 2024: 1 critical, 12 high. Days are UTC.

- [CVE-2024-4294](https://cve.now/CVE-2024-4294.md): PHPGurukul Doctor Appointment Management System view-appointment-detail.php resource injection (CVSS 6.3, PHPGurukul Doctor Appointment Management System)
- [CVE-2024-4293](https://cve.now/CVE-2024-4293.md): PHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php cross site scripting (CVSS 3.5, PHPGurukul Doctor Appointment Management System)
- [CVE-2024-4292](https://cve.now/CVE-2024-4292.md): Contemporary Controls BASrouter BACnet BASRT-B Device-Communication-Control Service denial of service (CVSS 6.5, Contemporary Controls BASrouter BACnet BASRT-B)
- [CVE-2024-4291](https://cve.now/CVE-2024-4291.md): Tenda A301 setBlackRule formAddMacfilterRule stack-based overflow (CVSS 8.8, Tenda A301)
- [CVE-2024-4257](https://cve.now/CVE-2024-4257.md): BlueNet Technology Clinical Browsing System deleteStudy.php sql injection (CVSS 6.3, BlueNet Technology Clinical Browsing System)
- [CVE-2024-4256](https://cve.now/CVE-2024-4256.md): Techkshetra Info Solutions Savsoft Quiz Category Page editCategory cross site scripting (CVSS 2.4, Techkshetra Info Solutions Savsoft Quiz)
- [CVE-2024-4255](https://cve.now/CVE-2024-4255.md): Ruijie RG-UAC gre\_edit\_commit.php os command injection (CVSS 4.7, Ruijie RG-UAC)
- [CVE-2024-4252](https://cve.now/CVE-2024-4252.md): Tenda i22 formSetUrlFilterRule stack-based overflow (CVSS 8.8, Tenda i22)
- [CVE-2024-4251](https://cve.now/CVE-2024-4251.md): Tenda i21 DhcpSetSe fromDhcpSetSer stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2024-25048](https://cve.now/CVE-2024-25048.md): IBM MQ code execution (CVSS 7.5, IBM MQ Appliance)
- [CVE-2024-4250](https://cve.now/CVE-2024-4250.md): Tenda i21 wifiSSIDset formwrlSSIDset stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2024-4249](https://cve.now/CVE-2024-4249.md): Tenda i21 wifiSSIDget formwrlSSIDget stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2024-4248](https://cve.now/CVE-2024-4248.md): Tenda i21 formQosManage\_user stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2024-3309](https://cve.now/CVE-2024-3309.md): Qi Addons For Elementor \<= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget (CVSS 6.4, qodeinteractive Qi Addons For Elementor)
- [CVE-2024-4247](https://cve.now/CVE-2024-4247.md): Tenda i21 formQosManage\_auto stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2023-1000](https://cve.now/CVE-2023-1000.md): cyanomiko dcnnt-py Notification notifications.py main command injection (CVSS 6.3, cyanomiko dcnnt-py · dcnnt)
- [CVE-2024-3342](https://cve.now/CVE-2024-3342.md): Timetable and Event Schedule by MotoPress \<= 2.4.11 - Authenticated (Contributor+) SQL Injection (CVSS 9.9, jetmonsters Timetable and Event Schedule by MotoPress)
- [CVE-2024-4246](https://cve.now/CVE-2024-4246.md): Tenda i21 formQosManageDouble\_auto stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2024-4245](https://cve.now/CVE-2024-4245.md): Tenda i21 formQosManageDouble\_user stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2024-3034](https://cve.now/CVE-2024-3034.md): BackUpWordPress \<= 3.13 - Authenticated (Admin+) Directory Traversal (CVSS 2.7, willmot BackUpWordPress)
- [CVE-2024-2838](https://cve.now/CVE-2024-2838.md): WPC Composite Products for WooCommerce \<= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, wpclever WPC Composite Products for WooCommerce)
- [CVE-2024-2258](https://cve.now/CVE-2024-2258.md): Form Maker by 10Web \<= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting (CVSS 4.4, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2024-2859](https://cve.now/CVE-2024-2859.md): By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859) (CVSS 6.8, Brocade SANnav)
- [CVE-2022-48684](https://cve.now/CVE-2022-48684.md): An issue was discovered in Logpoint before 7.1.1. (CVSS 8.4)
- [CVE-2022-48685](https://cve.now/CVE-2022-48685.md): An issue was discovered in Logpoint 7.1 before 7.1.2. (CVSS 7.7)
- [CVE-2023-52722](https://cve.now/CVE-2023-52722.md): An issue was discovered in Artifex Ghostscript before 10.03.1. (CVSS 5.5)
- [CVE-2024-33851](https://cve.now/CVE-2024-33851.md): phpecc, as used in paragonie/phpecc before 2.0.1, has a branch-based timing leak in Point addition. (CVSS 4.3, paragonie/ecc · mdanter/ecc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.