# CVEs published 2024-05-15

133 CVEs were published on May 15, 2024: 11 critical, 42 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-4919](https://cve.now/CVE-2024-4919.md): Campcodes Online Examination System addCourseExe.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-4918](https://cve.now/CVE-2024-4918.md): Campcodes Online Examination System updateQuestion.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-4917](https://cve.now/CVE-2024-4917.md): Campcodes Online Examination System submitAnswerExe.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-4916](https://cve.now/CVE-2024-4916.md): Campcodes Online Examination System selExamAttemptExe.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-4915](https://cve.now/CVE-2024-4915.md): Campcodes Online Examination System result.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-4914](https://cve.now/CVE-2024-4914.md): Campcodes Online Examination System ranking-exam.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-35184](https://cve.now/CVE-2024-35184.md): paperless-ngx's remote user auth via header works even when disabling it for API (CVSS 5.5, paperless-ngx)
- [CVE-2024-35183](https://cve.now/CVE-2024-35183.md): wolfictl leaks GitHub tokens to remote non-GitHub git servers (CVSS 4.4, wolfi-dev wolfictl · github.com/wolfi-dev/wolfictl)
- [CVE-2024-4913](https://cve.now/CVE-2024-4913.md): Campcodes Online Examination System exam.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-27244](https://cve.now/CVE-2024-27244.md): Zoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity (CVSS 6.7, Zoom Video Communications Zoom Workplace VDI App for Windows)
- [CVE-2024-4950](https://cve.now/CVE-2024-4950.md): Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage i (CVSS 5.3, Google Chrome)
- [CVE-2024-4949](https://cve.now/CVE-2024-4949.md): Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 9.6, Google Chrome)
- [CVE-2024-4948](https://cve.now/CVE-2024-4948.md): Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-4947](https://cve.now/CVE-2024-4947.md): Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 9.6, KEV, Google Chrome)
- [CVE-2024-27243](https://cve.now/CVE-2024-27243.md): Zoom Apps - Buffer Overflow (CVSS 6.5, Zoom Video Communications see references)
- [CVE-2024-4976](https://cve.now/CVE-2024-4976.md): Out-of-bounds array write in Xpdf 4.05 due to missing object type check (CVSS 2.1, Xpdf)
- [CVE-2024-4912](https://cve.now/CVE-2024-4912.md): Campcodes Online Examination System addExamExe.php sql injection (CVSS 5.3, Campcodes Online Examination System)
- [CVE-2024-4911](https://cve.now/CVE-2024-4911.md): Campcodes Complete Web-Based School Management System student\_exam\_mark\_update\_form.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-31409](https://cve.now/CVE-2024-31409.md): CyberPower PowerPanel business Incorrect Authorization (CVSS 6.5, CyberPower PowerPanel business)
- [CVE-2024-4910](https://cve.now/CVE-2024-4910.md): Campcodes Complete Web-Based School Management System student\_exam\_mark\_insert\_form1.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2023-40297](https://cve.now/CVE-2023-40297.md): Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component. (CVSS 7.5, github.com/stakater/Forecastle)
- [CVE-2024-31410](https://cve.now/CVE-2024-31410.md): CyberPower PowerPanel business Use of Hard-coded Cryptographic Key (CVSS 7.7, CyberPower PowerPanel business)
- [CVE-2024-31856](https://cve.now/CVE-2024-31856.md): CyberPower PowerPanel business SQL Injection (CVSS 8.8, CyberPower PowerPanel business)
- [CVE-2024-32042](https://cve.now/CVE-2024-32042.md): CyberPower PowerPanel business Storing Passwords in a Recoverable Format (CVSS 4.9, CyberPower PowerPanel business)
- [CVE-2024-32047](https://cve.now/CVE-2024-32047.md): CyberPower PowerPanel business Active Debug Code (CVSS 9.8, CyberPower PowerPanel business)
- [CVE-2024-32053](https://cve.now/CVE-2024-32053.md): CyberPower PowerPanel business Use of Hard-coded Credentials (CVSS 9.8, CyberPower PowerPanel business)
- [CVE-2024-4904](https://cve.now/CVE-2024-4904.md): Byzoro Smart S200 Management Platform userattestation.php unrestricted upload (CVSS 5.3, Byzoro Smart S200 Management Platform)
- [CVE-2024-34913](https://cve.now/CVE-2024-34913.md): An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafte (CVSS 5.4)
- [CVE-2024-34909](https://cve.now/CVE-2024-34909.md): An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file (CVSS 9.8)
- [CVE-2024-34906](https://cve.now/CVE-2024-34906.md): An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file. (CVSS 6.3)
- [CVE-2024-33615](https://cve.now/CVE-2024-33615.md): CyberPower PowerPanel business Relative Path Traversal (CVSS 8.8, CyberPower PowerPanel business)
- [CVE-2024-33625](https://cve.now/CVE-2024-33625.md): CyberPower PowerPanel business Use of Hard-coded Password (CVSS 9.8, CyberPower PowerPanel business)
- [CVE-2024-34025](https://cve.now/CVE-2024-34025.md): CyberPower PowerPanel business Use of Hard-coded Password (CVSS 9.8, CyberPower PowerPanel business)
- [CVE-2024-4909](https://cve.now/CVE-2024-4909.md): Campcodes Complete Web-Based School Management System student\_due\_payment.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4908](https://cve.now/CVE-2024-4908.md): Campcodes Complete Web-Based School Management System student\_attendance\_history1.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4907](https://cve.now/CVE-2024-4907.md): Campcodes Complete Web-Based School Management System show\_student2.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4906](https://cve.now/CVE-2024-4906.md): Campcodes Complete Web-Based School Management System show\_student1.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-35102](https://cve.now/CVE-2024-35102.md): Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a c (CVSS 8.8)
- [CVE-2024-3182](https://cve.now/CVE-2024-3182.md): Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6. (CVSS 6.5, TIBCO Hawk)
- [CVE-2024-20383](https://cve.now/CVE-2024-20383.md): Cisco Secure Email and Web Manager Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Secure Email and Web Manager)
- [CVE-2024-20257](https://cve.now/CVE-2024-20257.md): A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, (CVSS 4.8, Cisco Secure Email)
- [CVE-2024-20256](https://cve.now/CVE-2024-20256.md): A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Applia (CVSS 4.8, Cisco Secure Web Appliance · Cisco Secure Email and Web Man…)
- [CVE-2024-25743](https://cve.now/CVE-2024-25743.md): In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIG (CVSS 7.1)
- [CVE-2024-20258](https://cve.now/CVE-2024-20258.md): A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gate (CVSS 6.1, Cisco Secure Email)
- [CVE-2024-4905](https://cve.now/CVE-2024-4905.md): Kashipara College Management System view\_students\_each\_detail.php sql injection (CVSS 5.3, Kashipara College Management System)
- [CVE-2024-20366](https://cve.now/CVE-2024-20366.md): A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (CVSS 7.8, Cisco Network Services Orchestrator)
- [CVE-2024-20391](https://cve.now/CVE-2024-20391.md): A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical acce (CVSS 6.8, Cisco Secure Client)
- [CVE-2024-20369](https://cve.now/CVE-2024-20369.md): A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, (CVSS 4.7, Cisco Network Services Orchestrator)
- [CVE-2024-20392](https://cve.now/CVE-2024-20392.md): A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, rem (CVSS 6.1, Cisco Secure Email)
- [CVE-2024-20394](https://cve.now/CVE-2024-20394.md): A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (D (CVSS 5.5, Cisco AppDynamics)
- [CVE-2024-4837](https://cve.now/CVE-2024-4837.md): Trust Boundary Violation Vulnerability (CVSS 5.3, Progress Software Telerik Report Server)
- [CVE-2024-4357](https://cve.now/CVE-2024-4357.md): XML External Entity Processing Information Disclosure (CVSS 6.5, Progress Software Telerik Report Server)
- [CVE-2024-4200](https://cve.now/CVE-2024-4200.md): Progress Telerik Reporting Local Deserialization Vulnerability (CVSS 7.7, Progress Software Telerik Reporting)
- [CVE-2024-4622](https://cve.now/CVE-2024-4622.md): alpitronic Hypercharger EV Charger Use of Default Credentials (CVSS 8.3, alpitronic Hypercharger EV Charger)
- [CVE-2024-4202](https://cve.now/CVE-2024-4202.md): Progress Telerik Reporting Local Instantiation Vulnerability (CVSS 7.7, Progress Software Telerik Reporting)
- [CVE-2024-3488](https://cve.now/CVE-2024-3488.md): File Upload vulnerability in unauthenticated session found in iManager. (CVSS 5.6, OpenText iManager)
- [CVE-2024-3487](https://cve.now/CVE-2024-3487.md): Broken Authentication vulnerability in iManager (CVSS 3.5, OpenText iManager)
- [CVE-2024-3486](https://cve.now/CVE-2024-3486.md): XML External Entity injection vulnerability in iManager (CVSS 7.8, OpenText iManager)
- [CVE-2024-3485](https://cve.now/CVE-2024-3485.md): Server-Side Request Forgery vulnerability in iManager (CVSS 5.3, OpenText iManager)
- [CVE-2024-3484](https://cve.now/CVE-2024-3484.md): Path Traversal vulnerability found in iManager (CVSS 5.7, OpenText iManager)
- [CVE-2024-28042](https://cve.now/CVE-2024-28042.md): SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component (CVSS 8.4, SUBNET PowerSYSTEM Center)
- [CVE-2024-3483](https://cve.now/CVE-2024-3483.md): Remote Code Execution vulnerability in the iManager (CVSS 7.8, OpenText iManager)
- [CVE-2024-3892](https://cve.now/CVE-2024-3892.md): Local code execution vulnerability in Telerik UI for WinForms (CVSS 7.2, Progress Software Telerik UI for WinForms)
- [CVE-2024-34082](https://cve.now/CVE-2024-34082.md): Grav Arbitrary File Read to Account Takeover (CVSS 8.5, getgrav grav · getgrav/grav)
- [CVE-2024-3967](https://cve.now/CVE-2024-3967.md): Remote Code Execution vulnerability in the iManager (CVSS 7.6, OpenText iManager)
- [CVE-2024-3968](https://cve.now/CVE-2024-3968.md): Remote Code Execution vulnerability in the iManager (CVSS 7.8, OpenText iManager)
- [CVE-2024-3970](https://cve.now/CVE-2024-3970.md): Server-Side Request Forgery vulnerability in iManager (CVSS 5.3, OpenText iManager)
- [CVE-2024-27593](https://cve.now/CVE-2024-27593.md): A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated att (CVSS 5.4)
- [CVE-2023-7258](https://cve.now/CVE-2023-7258.md): Denial-of-Service in Gvisor (CVSS 4.8, Google Gvisor)
- [CVE-2023-5938](https://cve.now/CVE-2023-5938.md): Path traversal via 'zip slip' in Arc before v1.6.0 (CVSS 8.0, Nozomi Networks Arc)
- [CVE-2023-5937](https://cve.now/CVE-2023-5937.md): Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0 (CVSS 3.8, Nozomi Networks Arc)
- [CVE-2023-5936](https://cve.now/CVE-2023-5936.md): Unsafe temporary data privileges on Unix systems in Arc before v1.6.0 (CVSS 7.8, Nozomi Networks Arc)
- [CVE-2023-5935](https://cve.now/CVE-2023-5935.md): Missing authentication for local web interface in Arc before v1.6.0 (CVSS 7.4, Nozomi Networks Arc)
- [CVE-2024-35179](https://cve.now/CVE-2024-35179.md): Unprivileged Stalwart Mail Server user can read files as root (CVSS 6.8, stalwartlabs mail-server)
- [CVE-2024-3317](https://cve.now/CVE-2024-3317.md): SailPoint Identity Security Cloud Improper Access Control (CVSS 6.5, SailPoint Identity Security Cloud)
- [CVE-2024-31216](https://cve.now/CVE-2024-31216.md): source-controller leaks theAzure Storage SAS token into logs on connection errors (CVSS 5.1, fluxcd source-controller · github.com/fluxcd/source-control…)
- [CVE-2024-3318](https://cve.now/CVE-2024-3318.md): SailPoint Identity Security Cloud Connector File Path Traversal Vulnerability (CVSS 4.2, SailPoint Identity Security Cloud)
- [CVE-2024-3319](https://cve.now/CVE-2024-3319.md): Security implication in SailPoint Identity Security Cloud IdentityProfile API Endpoints (CVSS 9.1, SailPoint Identity Security Cloud)
- [CVE-2024-4903](https://cve.now/CVE-2024-4903.md): Tongda OA delete.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-25079](https://cve.now/CVE-2024-25079.md): A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 befo (CVSS 7.4)
- [CVE-2024-27353](https://cve.now/CVE-2024-27353.md): A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kern (CVSS 7.4)
- [CVE-2024-34955](https://cve.now/CVE-2024-34955.md): Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter. (CVSS 9.8)
- [CVE-2024-34954](https://cve.now/CVE-2024-34954.md): Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter. (CVSS 6.1)
- [CVE-2024-25078](https://cve.now/CVE-2024-25078.md): A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB (CVSS 7.4)
- [CVE-2024-2248](https://cve.now/CVE-2024-2248.md): JFrog Artifactory Header Injection (CVSS 6.4, JFrog Artifactory)
- [CVE-2024-4670](https://cve.now/CVE-2024-4670.md): All-in-One Video Gallery \<= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg\_search\_form Shortcode (CVSS 8.8, plugins360 All-in-One Video Gallery)
- [CVE-2023-6324](https://cve.now/CVE-2023-6324.md): ThroughTek Kalay SDK error in handling the PSK identity (CVSS 8.1, ThroughTek Kalay SDK)
- [CVE-2023-6323](https://cve.now/CVE-2023-6323.md): ThroughTek Kalay SDK insufficient verification of message authenticity (CVSS 4.3, ThroughTek Kalay SDK)
- [CVE-2023-6322](https://cve.now/CVE-2023-6322.md): Stack-based buffer overflow in message parser functionality (CVSS 7.2, Roku Indoor Camera SE · Wyze Cam)
- [CVE-2023-6321](https://cve.now/CVE-2023-6321.md): Owlet Camera OS command injection (CVSS 7.2, Owlet Cam)
- [CVE-2024-4702](https://cve.now/CVE-2024-4702.md): Mega Elements \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4, kraftplugins Mega Elements – Addons for Elementor)
- [CVE-2024-34100](https://cve.now/CVE-2024-34100.md): Use-After-Free vulnerability in the latest Adobe Acrobat Reader DC when open malicious PDF file (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-34101](https://cve.now/CVE-2024-34101.md): ZDI-CAN-23614: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-30284](https://cve.now/CVE-2024-30284.md): ZDI-CAN-23466: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-34098](https://cve.now/CVE-2024-34098.md): ZDI-CAN-XXXX: \[Pwn2Own\] Acrobat sandbox bypass part 1 of 2 (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-30312](https://cve.now/CVE-2024-30312.md): TALOS-2024-1952 - Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-30311](https://cve.now/CVE-2024-30311.md): TALOS-2024-1946 - Adobe Acrobat Reader Font gvar GlyphVariationData out-of-bounds read vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-34095](https://cve.now/CVE-2024-34095.md): ZDI-CAN-23475: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-34099](https://cve.now/CVE-2024-34099.md): ZDI-CAN-XXXX: \[Pwn2Own\] Acrobat sandbox bypass part 2 of 2 (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-34096](https://cve.now/CVE-2024-34096.md): ZDI-CAN-23472: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-34097](https://cve.now/CVE-2024-34097.md): ZDI-CAN-23473: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-34094](https://cve.now/CVE-2024-34094.md): ZDI-CAN-23474: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-30310](https://cve.now/CVE-2024-30310.md): ZDI-CAN-23327: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-4010](https://cve.now/CVE-2024-4010.md): Email Subscribers by Icegram Express \<= 5.7.19 - Missing Authorization in handle\_ajax\_request (CVSS 8.8, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-4636](https://cve.now/CVE-2024-4636.md): Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF \<= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 6.4, Optimole – Optimize Images in Real Time)
- [CVE-2024-3824](https://cve.now/CVE-2024-3824.md): Base64 Encoder/Decoder \<= 0.9.2 - Settings Reset via CSRF (CVSS 5.5, Base64 Encoder/Decoder)
- [CVE-2024-3823](https://cve.now/CVE-2024-3823.md): Base64 Encoder/Decoder \<= 0.9.2 - Stored XSS via CSRF (CVSS 2.4, Base64 Encoder/Decoder)
- [CVE-2024-3822](https://cve.now/CVE-2024-3822.md): Base64 Encoder/Decoder \<= 0.9.2 - Reflected XSS (CVSS 4.8, Base64 Encoder/Decoder)
- [CVE-2024-3749](https://cve.now/CVE-2024-3749.md): SP Project & Document Manager \<= 4.71 - Subscriber+ File Download via IDOR (CVSS 6.5, SP Project & Document Manager)
- [CVE-2024-3748](https://cve.now/CVE-2024-3748.md): SP Project & Document Manager \<= 4.71 - Data Update via IDOR (CVSS 6.5, SP Project & Document Manager)
- [CVE-2024-3634](https://cve.now/CVE-2024-3634.md): month name translation benaceur \< 2.3.8 - Admin+ Stored XSS (CVSS 4.8, month name translation benaceur)
- [CVE-2024-3631](https://cve.now/CVE-2024-3631.md): HL Twitter \<= 2014.1.18 - Unlink Twitter Account via CSRF (CVSS 4.3, HL Twitter)
- [CVE-2024-3630](https://cve.now/CVE-2024-3630.md): HL Twitter \<= 2014.1.18 - Admin+ Stored XSS via Widget (CVSS 5.4, HL Twitter)
- [CVE-2024-3629](https://cve.now/CVE-2024-3629.md): HL Twitter \<= 2014.1.18 - Settings Update via CSRF (CVSS 2.4, HL Twitter)
- [CVE-2024-3548](https://cve.now/CVE-2024-3548.md): Shortcodes Ultimate \< 7.1.2 - Contributor+ Stored XSS (CVSS 6.1, WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-3407](https://cve.now/CVE-2024-3407.md): WP Prayer \<= 2.0.9 - Arbitrary Prayer Deletion via CSRF (CVSS 5.3, WP Prayer)
- [CVE-2024-3406](https://cve.now/CVE-2024-3406.md): WP Prayer \<= 2.0.9 - Email Settings Update via CSRF (CVSS 8.8, WP Prayer)
- [CVE-2024-3405](https://cve.now/CVE-2024-3405.md): WP Prayer \<= 2.0.9 - Settings Update via CSRF (CVSS 7.6, WP Prayer)
- [CVE-2024-4894](https://cve.now/CVE-2024-4894.md): ITPison OMICARD EDM - Server-Side Request Forgery (CVSS 5.3, ITPison OMICARD EDM)
- [CVE-2024-4208](https://cve.now/CVE-2024-4208.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-3189](https://cve.now/CVE-2024-3189.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-4893](https://cve.now/CVE-2024-4893.md): DigiWin EasyFlow .NET - SQL Injection (CVSS 9.8, DigiWin EasyFlow .NET)
- [CVE-2024-32888](https://cve.now/CVE-2024-32888.md): Amazon JDBC Driver for Redshift SQL Injection via line comment generation (CVSS 10.0, aws amazon-redshift-jdbc-driver · com.amazon.redshift:redsh…)
- [CVE-2024-35109](https://cve.now/CVE-2024-35109.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro\_deal.php?mudi=add&nohrefStr=close. (CVSS 6.5)
- [CVE-2024-35108](https://cve.now/CVE-2024-35108.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro\_deal.php?mudi=del&dataType=&data (CVSS 8.8)
- [CVE-2024-4373](https://cve.now/CVE-2024-4373.md): Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) \<= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer' (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2024-4656](https://cve.now/CVE-2024-4656.md): Import and export users and customers \<= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, carazo Import and export users and customers)
- [CVE-2024-4199](https://cve.now/CVE-2024-4199.md): Bulk Posts Editing For WordPress \<= 4.2.3 - Authenticated (Subscriber+) Missing Authorization (CVSS 4.3, ithemelandco WPBULKiT – Bulk Edit WordPress Posts & Pages)
- [CVE-2024-4847](https://cve.now/CVE-2024-4847.md): Alt Text AI – Automatically generate image alt text for SEO and accessibility \<= 1.4.9 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, alttextai Alt Text AI – Automatically generate image alt te…)
- [CVE-2024-4618](https://cve.now/CVE-2024-4618.md): Exclusive Addons for Elementor \<= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-4734](https://cve.now/CVE-2024-4734.md): Import and export users and customers \<= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, carazo Import and export users and customers)
- [CVE-2024-3744](https://cve.now/CVE-2024-3744.md): Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs (CVSS 6.5, Kubernetes azure-file-csi-driver · sigs.k8s.io/azurefile-cs…)
- [CVE-2024-28087](https://cve.now/CVE-2024-28087.md): In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. (CVSS 6.5, org.bonitasoft.engine:bonita-server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.