# CVEs published 2024-05-06 151 CVEs were published on May 6, 2024: 11 critical, 54 high. Days are UTC. - [CVE-2024-2913](https://cve.now/CVE-2024-2913.md): Race Condition Vulnerability in mintplex-labs/anything-llm (CVSS 6.5, mintplex-labs/anything-llm) - [CVE-2024-29941](https://cve.now/CVE-2024-29941.md): Credential Cloning (CVSS 8.0, Integrated Control Technology TSEC) - [CVE-2024-1695](https://cve.now/CVE-2024-1695.md): A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which migh (CVSS 5.7, HP Application Enabling Software Driver) - [CVE-2024-34413](https://cve.now/CVE-2024-34413.md): WordPress SliceWP Affiliates plugin \<= 1.1.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, SliceWP) - [CVE-2024-4568](https://cve.now/CVE-2024-4568.md): Stack overflow in Xpdf 4.05 due to object loop in PDF resources (CVSS 2.9, Xpdf) - [CVE-2024-33570](https://cve.now/CVE-2024-33570.md): WordPress MetForm plugin \<= 3.8.3 - Broken Access Control vulnerability (CVSS 4.3, Roxnor Metform) - [CVE-2024-33576](https://cve.now/CVE-2024-33576.md): WordPress WPPizza plugin \<= 3.18.10 - Broken Access Control vulnerability (CVSS 6.5, Ollybach WPPizza) - [CVE-2024-33602](https://cve.now/CVE-2024-33602.md): nscd: netgroup cache assumes NSS callback uses in-buffer strings (CVSS 7.4, The GNU C Library glibc) - [CVE-2024-33601](https://cve.now/CVE-2024-33601.md): nscd: netgroup cache may terminate daemon on memory allocation failure (CVSS 7.3, The GNU C Library glibc) - [CVE-2024-33600](https://cve.now/CVE-2024-33600.md): nscd: Null pointer crashes after notfound response (CVSS 5.9, The GNU C Library glibc) - [CVE-2024-33599](https://cve.now/CVE-2024-33599.md): nscd: Stack-based buffer overflow in netgroup cache (CVSS 8.1, The GNU C Library glibc) - [CVE-2024-33907](https://cve.now/CVE-2024-33907.md): WordPress Print My Blog plugin \<= 3.26.2 - Broken Access Control vulnerability (CVSS 5.3, Michael Nelson Print My Blog) - [CVE-2024-33908](https://cve.now/CVE-2024-33908.md): WordPress WidgetKit plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 5.3, Themesgrove WidgetKit) - [CVE-2024-33910](https://cve.now/CVE-2024-33910.md): WordPress Digital Publications by Supsystic plugin \<= 1.7.7 - Broken Access Control vulnerability (CVSS 5.3, Digital Publications by Supsystic) - [CVE-2024-33912](https://cve.now/CVE-2024-33912.md): WordPress Academy LMS plugin \<= 1.9.16 - Broken Access Control on Paid Courses vulnerability (CVSS 7.1, Academy LMS) - [CVE-2024-34371](https://cve.now/CVE-2024-34371.md): WordPress Login with phone number plugin \<= 1.7.18 - Broken Access Control vulnerability (CVSS 4.3, Hamid Alinia Login with phone number) - [CVE-2024-34372](https://cve.now/CVE-2024-34372.md): WordPress Post Grid Master plugin \<= 3.4.7 - Broken Access Control vulnerability (CVSS 5.3, AddonMaster Post Grid Master) - [CVE-2024-34377](https://cve.now/CVE-2024-34377.md): WordPress Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 4.3, A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, L…) - [CVE-2024-34378](https://cve.now/CVE-2024-34378.md): WordPress LeadConnector plugin \<= 1.7 - API Broken Access Control vulnerability (CVSS 8.6, LeadConnector) - [CVE-2024-34387](https://cve.now/CVE-2024-34387.md): WordPress WP Post Author plugin \<= 3.6.4 - Rating Value Manipulation vulnerability (CVSS 4.3, AF themes WP Post Author) - [CVE-2024-34389](https://cve.now/CVE-2024-34389.md): WordPress WP Post Author plugin \<= 3.6.4 - Broken Access Control vulnerability (CVSS 4.3, AF themes WP Post Author) - [CVE-2024-34366](https://cve.now/CVE-2024-34366.md): WordPress AltText.ai plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AltText.ai Download Alt Text AI) - [CVE-2024-34369](https://cve.now/CVE-2024-34369.md): WordPress Web Push Notifications – Webpushr plugin \<= 4.35.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Webpushr Web Push Notifications Webpushr) - [CVE-2024-3661](https://cve.now/CVE-2024-3661.md): DHCP routing options can manipulate interface-based VPN traffic (CVSS 7.6, IETF DHCP) - [CVE-2024-34373](https://cve.now/CVE-2024-34373.md): WordPress The Plus Addons for Elementor plugin \<= 5.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite) - [CVE-2024-34374](https://cve.now/CVE-2024-34374.md): WordPress ElementsReady Addons for Elementor plugin \<= 5.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, QuomodoSoft ElementsReady Addons for Elementor) - [CVE-2024-34375](https://cve.now/CVE-2024-34375.md): WordPress Sheets to WP Table Live Sync plugin \<= 3.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPPOOL Sheets To WP Table Live Sync) - [CVE-2024-34376](https://cve.now/CVE-2024-34376.md): WordPress Edge theme \<= 2.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Theme Freesia Edge) - [CVE-2024-34380](https://cve.now/CVE-2024-34380.md): WordPress ChatBot Conversational Forms plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, QuantumCloud Conversational Forms for ChatBot) - [CVE-2024-34381](https://cve.now/CVE-2024-34381.md): WordPress PropertyHive plugin \<= 2.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PropertyHive) - [CVE-2024-34390](https://cve.now/CVE-2024-34390.md): WordPress Post Grid Master plugin \<= 3.4.8 - Auth. Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AddonMaster Post Grid Master) - [CVE-2024-34379](https://cve.now/CVE-2024-34379.md): WordPress Restaurant and Cafe theme \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rara Theme Restaurant and Cafe) - [CVE-2024-34367](https://cve.now/CVE-2024-34367.md): WordPress Popup Box plugin \<= 4.1.2 - CSRF to XSS vulnerability (CVSS 7.1, Popup Box Team Popup box) - [CVE-2024-34386](https://cve.now/CVE-2024-34386.md): WordPress Auto Affiliate Links plugin \<= 6.4.3.1 - SQL Injection vulnerability (CVSS 7.6, Lucian Apostol Auto Affiliate Links) - [CVE-2024-34412](https://cve.now/CVE-2024-34412.md): WordPress ParcelPanel plugin \<= 3.8.1 - Auth. SQL Injection vulnerability (CVSS 8.5, Parcel Panel ParcelPanel) - [CVE-2024-34368](https://cve.now/CVE-2024-34368.md): WordPress Mooberry Book Manager plugin \<= 4.15.12 - Sensitive Data Exposure vulnerability (CVSS 5.3, Mooberry Dreams Mooberry Book Manager) - [CVE-2024-34382](https://cve.now/CVE-2024-34382.md): WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin \<= 3.2.18 - Sensitive Data Exposure vulnerability (CVSS 5.3, RoboSoft Robo Gallery) - [CVE-2024-34383](https://cve.now/CVE-2024-34383.md): WordPress SEOPress plugin \<= 7.7.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, The SEO Guys at SEOPress SEOPress) - [CVE-2024-34388](https://cve.now/CVE-2024-34388.md): WordPress GDPR Compliance plugin \<= 1.2.5 - Sensitive Data Exposure vulnerability (CVSS 7.5, Scribit GDPR Compliance) - [CVE-2024-32807](https://cve.now/CVE-2024-32807.md): WordPress Brevo for WooCommerce plugin \<= 4.0.17 - Arbitrary File Download and Deletion vulnerability (CVSS 8.5, Brevo Sendinblue for WooCommerce) - [CVE-2024-34078](https://cve.now/CVE-2024-34078.md): html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization (CVSS 6.1, matthiask html-sanitizer · html-sanitizer) - [CVE-2024-34069](https://cve.now/CVE-2024-34069.md): Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution (CVSS 7.5, pallets werkzeug · werkzeug) - [CVE-2024-34064](https://cve.now/CVE-2024-34064.md): Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter (CVSS 5.4, pallets jinja · jinja2) - [CVE-2024-32982](https://cve.now/CVE-2024-32982.md): Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 8.2, litestar-org litestar · starlite +1) - [CVE-2024-23354](https://cve.now/CVE-2024-23354.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon) - [CVE-2024-23351](https://cve.now/CVE-2024-23351.md): Improper Access Control in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon) - [CVE-2024-21480](https://cve.now/CVE-2024-21480.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Audio (CVSS 7.3, Qualcomm Snapdragon) - [CVE-2024-21477](https://cve.now/CVE-2024-21477.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon) - [CVE-2024-21476](https://cve.now/CVE-2024-21476.md): Improper Input Validation in Secure Processor (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2024-21475](https://cve.now/CVE-2024-21475.md): Use of Out-of-range Pointer Offset in Video (CVSS 7.8, Qualcomm Snapdragon) - [CVE-2024-21474](https://cve.now/CVE-2024-21474.md): Stack-based Buffer Overflow in PMIC (CVSS 8.4, Qualcomm Snapdragon) - [CVE-2024-21471](https://cve.now/CVE-2024-21471.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon) - [CVE-2023-43531](https://cve.now/CVE-2023-43531.md): Access of Uninitialized Pointer in SPS Applications (CVSS 8.4, Qualcomm Snapdragon) - [CVE-2023-43530](https://cve.now/CVE-2023-43530.md): Integer Overflow or Wraparound in HLOS (CVSS 5.9, Qualcomm Snapdragon) - [CVE-2023-43529](https://cve.now/CVE-2023-43529.md): Reachable Assertion in Data Modem (CVSS 7.5, Qualcomm Snapdragon) - [CVE-2023-43528](https://cve.now/CVE-2023-43528.md): Buffer Over-read in Audio (CVSS 6.1, Qualcomm Snapdragon) - [CVE-2023-43527](https://cve.now/CVE-2023-43527.md): Buffer Over-read in Video (CVSS 6.8, Qualcomm Snapdragon) - [CVE-2023-43526](https://cve.now/CVE-2023-43526.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Audio (CVSS 6.7, Qualcomm Snapdragon) - [CVE-2023-43525](https://cve.now/CVE-2023-43525.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Audio (CVSS 6.7, Qualcomm Snapdragon) - [CVE-2023-43524](https://cve.now/CVE-2023-43524.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Audio (CVSS 6.7, Qualcomm Snapdragon) - [CVE-2023-43521](https://cve.now/CVE-2023-43521.md): Use After Free in HLOS (CVSS 6.7, Qualcomm Snapdragon) - [CVE-2023-33119](https://cve.now/CVE-2023-33119.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor (CVSS 8.4, Qualcomm Snapdragon) - [CVE-2024-32972](https://cve.now/CVE-2024-32972.md): go-ethereum denial of service via malicious p2p message (CVSS 7.5, go-ethereum · github.com/ethereum/go-ethereum) - [CVE-2024-4549](https://cve.now/CVE-2024-4549.md): Delta Electronics DIAEnergie SQL Injection (CVSS 7.5, Delta Electronics DIAEnergie) - [CVE-2024-4548](https://cve.now/CVE-2024-4548.md): Delta Electronics DIAEnergie SQL Injection (CVSS 9.8, Delta Electronics DIAEnergie) - [CVE-2024-4547](https://cve.now/CVE-2024-4547.md): Delta Electronics DIAEnergie Unauthenticated SQL Injection (CVSS 9.8, Delta Electronics DIAEnergie) - [CVE-2024-3576](https://cve.now/CVE-2024-3576.md): NPort 5100A Series Store XSS Vulnerability (CVSS 8.3, Moxa NPort 5100A Series) - [CVE-2023-49676](https://cve.now/CVE-2023-49676.md): CODESYS: Use after free vulnerability through corrupted project files (CVSS 5.5, CODESYS Development System) - [CVE-2023-49675](https://cve.now/CVE-2023-49675.md): CODESYS: Out-of-bounds write through corrupted project files (CVSS 7.8, CODESYS Development System) - [CVE-2023-6854](https://cve.now/CVE-2023-6854.md): Breakdance \<= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta (CVSS 6.4, Breakdance) - [CVE-2024-23193](https://cve.now/CVE-2024-23193.md): E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. (CVSS 5.3, Open-Xchange OX App Suite) - [CVE-2024-23188](https://cve.now/CVE-2024-23188.md): Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. (CVSS 6.5, Open-Xchange OX App Suite) - [CVE-2024-23187](https://cve.now/CVE-2024-23187.md): Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. (CVSS 6.5, Open-Xchange OX App Suite) - [CVE-2024-23186](https://cve.now/CVE-2024-23186.md): E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. (CVSS 6.5, Open-Xchange OX App Suite) - [CVE-2024-4528](https://cve.now/CVE-2024-4528.md): SourceCodester Prison Management System user-record.php cross site scripting (CVSS 2.4, SourceCodester Prison Management System) - [CVE-2024-4527](https://cve.now/CVE-2024-4527.md): Campcodes Complete Web-Based School Management System student\_payment\_details2.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4526](https://cve.now/CVE-2024-4526.md): Campcodes Complete Web-Based School Management System student\_payment\_details3.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-3756](https://cve.now/CVE-2024-3756.md): MF Gig Calendar \<= 1.2.1 - Arbitrary Event Deletion via CSRF (CVSS 7.5, MF Gig Calendar) - [CVE-2024-3755](https://cve.now/CVE-2024-3755.md): MF Gig Calendar \<= 1.2.1 - Editor+ Stored XSS (CVSS 5.4, MF Gig Calendar) - [CVE-2024-3752](https://cve.now/CVE-2024-3752.md): Crelly Slider \<= 1.4.5 - Admin+ Stored XSS (CVSS 5.4, Crelly Slider) - [CVE-2024-0904](https://cve.now/CVE-2024-0904.md): Fancy Product Designer \< 6.1.81 - Admin+ Cross Site Scripting (CVSS 5.9, Fancy Product Designer) - [CVE-2024-4525](https://cve.now/CVE-2024-4525.md): Campcodes Complete Web-Based School Management System student\_payment\_details4.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4524](https://cve.now/CVE-2024-4524.md): Campcodes Complete Web-Based School Management System student\_payment\_invoice.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4523](https://cve.now/CVE-2024-4523.md): Campcodes Complete Web-Based School Management System teacher\_attendance\_history1.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4522](https://cve.now/CVE-2024-4522.md): Campcodes Complete Web-Based School Management System teacher\_salary\_details.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4521](https://cve.now/CVE-2024-4521.md): Campcodes Complete Web-Based School Management System teacher\_salary\_details2.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4519](https://cve.now/CVE-2024-4519.md): Campcodes Complete Web-Based School Management System teacher\_salary\_details3.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4518](https://cve.now/CVE-2024-4518.md): Campcodes Complete Web-Based School Management System teacher\_salary\_invoice.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4517](https://cve.now/CVE-2024-4517.md): Campcodes Complete Web-Based School Management System teacher\_salary\_invoice1.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-20021](https://cve.now/CVE-2024-20021.md): In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. (CVSS 6.7, MediaTek MT6768, MT6781, MT6785, MT6833, MT6853, MT6873, MT…) - [CVE-2024-20064](https://cve.now/CVE-2024-20064.md): In wlan service, there is a possible out of bounds write due to improper input validation. (CVSS 7.8, MediaTek MT6580, MT6761, MT6762, MT6768, MT6781, MT6789, MT…) - [CVE-2024-20060](https://cve.now/CVE-2024-20060.md): In da, there is a possible escalation of privilege due to an incorrect status check. (CVSS 5.9, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…) - [CVE-2024-20059](https://cve.now/CVE-2024-20059.md): In da, there is a possible escalation of privilege due to an incorrect status check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…) - [CVE-2024-20058](https://cve.now/CVE-2024-20058.md): In keyInstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6765, MT6768, MT6785, MT6833, MT6853, MT6855, MT…) - [CVE-2023-32871](https://cve.now/CVE-2023-32871.md): In DA, there is a possible permission bypass due to an incorrect status check. (CVSS 5.3, MediaTek MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT…) - [CVE-2023-32873](https://cve.now/CVE-2023-32873.md): In keyInstall, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.4, MediaTek MT6761, MT6765, MT6768, MT6833, MT6853, MT6855, MT…) - [CVE-2024-20057](https://cve.now/CVE-2024-20057.md): In keyInstall, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.2, MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…) - [CVE-2024-20056](https://cve.now/CVE-2024-20056.md): In preloader, there is a possible escalation of privilege due to an insecure default value. (CVSS 6.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6785, MT…) - [CVE-2024-4516](https://cve.now/CVE-2024-4516.md): Campcodes Complete Web-Based School Management System timetable.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4515](https://cve.now/CVE-2024-4515.md): Campcodes Complete Web-Based School Management System timetable\_grade\_wise.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4514](https://cve.now/CVE-2024-4514.md): Campcodes Complete Web-Based School Management System timetable\_insert\_form.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4513](https://cve.now/CVE-2024-4513.md): Campcodes Complete Web-Based School Management System timetable\_update\_form.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System) - [CVE-2024-4512](https://cve.now/CVE-2024-4512.md): SourceCodester Prison Management System edit-profile.php cross site scripting (CVSS 3.5, SourceCodester Prison Management System) - [CVE-2024-4511](https://cve.now/CVE-2024-4511.md): Shanghai Sunfull Automation BACnet Server HMI1002-ARM Message buffer overflow (CVSS 6.3, Shanghai Sunfull Automation BACnet Server HMI1002-ARM) - [CVE-2024-4510](https://cve.now/CVE-2024-4510.md): Ruijie RG-UAC arp\_add\_commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4509](https://cve.now/CVE-2024-4509.md): Ruijie RG-UAC add\_commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4508](https://cve.now/CVE-2024-4508.md): Ruijie RG-UAC static\_route\_edit\_ipv6.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2023-33548](https://cve.now/CVE-2023-33548.md): Cross Site Scripting (XSS) vulnerability in ASUS RT-AC51U with firmware versions up to and including 3.0.0.4.380.8591 allows attackers to ru (CVSS 6.8) - [CVE-2024-26312](https://cve.now/CVE-2024-26312.md): Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. (CVSS 4.3) - [CVE-2024-28725](https://cve.now/CVE-2024-28725.md): Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and S (CVSS 7.1) - [CVE-2024-30973](https://cve.now/CVE-2024-30973.md): An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitiv (CVSS 8.8) - [CVE-2024-33110](https://cve.now/CVE-2024-33110.md): D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component. (CVSS 9.1) - [CVE-2024-33111](https://cve.now/CVE-2024-33111.md): D-Link DIR-845L router \<=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc\_sms\_inbox.php. (CVSS 5.4) - [CVE-2024-33112](https://cve.now/CVE-2024-33112.md): D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap\_main()func. (CVSS 7.5) - [CVE-2024-33113](https://cve.now/CVE-2024-33113.md): D-LINK DIR-845L \<=v1.01KRb03 is vulnerable to Information disclosurey via bsc\_sms\_inbox.php. (CVSS 5.3) - [CVE-2024-33117](https://cve.now/CVE-2024-33117.md): crmeb\_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageM (CVSS 5.3) - [CVE-2024-33118](https://cve.now/CVE-2024-33118.md): LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.c (CVSS 7.5) - [CVE-2024-33121](https://cve.now/CVE-2024-33121.md): Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function. (CVSS 6.3) - [CVE-2024-33294](https://cve.now/CVE-2024-33294.md): An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the \_FAILE variable (CVSS 9.1) - [CVE-2024-33403](https://cve.now/CVE-2024-33403.md): A SQL injection vulnerability in /model/get\_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execu (CVSS 9.8) - [CVE-2024-33404](https://cve.now/CVE-2024-33404.md): A SQL injection vulnerability in /model/add\_student\_first\_payment.php in campcodes Complete Web-Based School Management System 1.0 allows at (CVSS 8.3) - [CVE-2024-33405](https://cve.now/CVE-2024-33405.md): SQL injection vulnerability in add\_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbit (CVSS 8.6) - [CVE-2024-33406](https://cve.now/CVE-2024-33406.md): SQL injection vulnerability in /model/delete\_student\_grade\_subject.php in campcodes Complete Web-Based School Management System 1.0 allows a (CVSS 7.3) - [CVE-2024-33407](https://cve.now/CVE-2024-33407.md): SQL injection vulnerability in /model/delete\_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to exec (CVSS 5.9) - [CVE-2024-33408](https://cve.now/CVE-2024-33408.md): A SQL injection vulnerability in /model/get\_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to ex (CVSS 9.8) - [CVE-2024-33409](https://cve.now/CVE-2024-33409.md): SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary S (CVSS 9.8) - [CVE-2024-33410](https://cve.now/CVE-2024-33410.md): SQL injection vulnerability in /model/delete\_range\_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to (CVSS 8.1) - [CVE-2024-33411](https://cve.now/CVE-2024-33411.md): A SQL injection vulnerability in /model/get\_admin\_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker t (CVSS 9.8) - [CVE-2024-33749](https://cve.now/CVE-2024-33749.md): DedeCMS V5.7.114 is vulnerable to deletion of any file via mail\_file\_manage.php. (CVSS 9.1) - [CVE-2024-33752](https://cve.now/CVE-2024-33752.md): An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote (CVSS 6.3) - [CVE-2024-33753](https://cve.now/CVE-2024-33753.md): Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed (CVSS 8.2) - [CVE-2024-33788](https://cve.now/CVE-2024-33788.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint. (CVSS 8.0) - [CVE-2024-33829](https://cve.now/CVE-2024-33829.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache. (CVSS 5.4) - [CVE-2024-33830](https://cve.now/CVE-2024-33830.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache. (CVSS 8.1) - [CVE-2024-34089](https://cve.now/CVE-2024-34089.md): An issue was discovered in Archer Platform 6 before 2024.04. (CVSS 7.3) - [CVE-2024-34090](https://cve.now/CVE-2024-34090.md): An issue was discovered in Archer Platform 6 before 2024.04. (CVSS 7.3) - [CVE-2024-34091](https://cve.now/CVE-2024-34091.md): An issue was discovered in Archer Platform 6 before 2024.04. (CVSS 7.3) - [CVE-2024-34092](https://cve.now/CVE-2024-34092.md): An issue was discovered in Archer Platform 6 before 2024.04. (CVSS 6.3) - [CVE-2024-34093](https://cve.now/CVE-2024-34093.md): An issue was discovered in Archer Platform 6 before 2024.03. (CVSS 5.3) - [CVE-2024-34246](https://cve.now/CVE-2024-34246.md): wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platfo (CVSS 7.5, pywasm3) - [CVE-2024-34249](https://cve.now/CVE-2024-34249.md): wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/s (CVSS 9.8, pywasm3) - [CVE-2024-34250](https://cve.now/CVE-2024-34250.md): A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a (CVSS 6.2) - [CVE-2024-34251](https://cve.now/CVE-2024-34251.md): An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to ca (CVSS 7.5) - [CVE-2024-34252](https://cve.now/CVE-2024-34252.md): wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupi (CVSS 7.5, pywasm3) - [CVE-2024-34470](https://cve.now/CVE-2024-34470.md): An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. (CVSS 8.6) - [CVE-2024-34471](https://cve.now/CVE-2024-34471.md): An issue was discovered in HSC Mailinspector 5.2.17-3. (CVSS 5.4) - [CVE-2024-34472](https://cve.now/CVE-2024-34472.md): An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. (CVSS 5.5) - [CVE-2024-34532](https://cve.now/CVE-2024-34532.md): A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query\_deluxe) 17.x before 17.0.0.4 allows a remote attacker (CVSS 9.8) - [CVE-2024-34533](https://cve.now/CVE-2024-34533.md): A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi\_data) 11.0 through 17.x before 17.0.3 allows a (CVSS 7.3) - [CVE-2024-34534](https://cve.now/CVE-2024-34534.md): A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text\_commander) 16.0 through 16.0.1 allows a remote at (CVSS 7.3) - [CVE-2024-34538](https://cve.now/CVE-2024-34538.md): Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography. (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-05-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.