# CVEs published 2024-05-18

26 CVEs were published on May 18, 2024: 4 critical, 5 high. Days are UTC.

- [CVE-2024-28064](https://cve.now/CVE-2024-28064.md): Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated fil (CVSS 9.8)
- [CVE-2024-28063](https://cve.now/CVE-2024-28063.md): Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS. (CVSS 6.1)
- [CVE-2024-36050](https://cve.now/CVE-2024-36050.md): Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker (CVSS 4.3)
- [CVE-2024-5094](https://cve.now/CVE-2024-5094.md): SourceCodester Best House Rental Management System view\_payment.php sql injection (CVSS 6.9, SourceCodester Best House Rental Management System)
- [CVE-2024-36043](https://cve.now/CVE-2024-36043.md): question\_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property. (CVSS 6.1)
- [CVE-2024-5093](https://cve.now/CVE-2024-5093.md): SourceCodester Best House Rental Management System login.php sql injection (CVSS 6.9, SourceCodester Best House Rental Management System)
- [CVE-2024-34083](https://cve.now/CVE-2024-34083.md): STARTTLS unencrypted commands injection (CVSS 5.4, aio-libs aiosmtpd · aiosmtpd)
- [CVE-2024-31879](https://cve.now/CVE-2024-31879.md): IBM i denial of service (CVSS 7.5, IBM i)
- [CVE-2024-3745](https://cve.now/CVE-2024-3745.md): MSI Afterburner v4.6.6.16381 Beta 3 - ACL Bypass (CVSS 7.8, MSI Afterburner)
- [CVE-2024-5088](https://cve.now/CVE-2024-5088.md): Happy Addons for Elementor \<= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-4432](https://cve.now/CVE-2024-4432.md): Piotnet Addons For Elementor \<= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, piotnetdotcom Piotnet Addons For Elementor)
- [CVE-2024-4709](https://cve.now/CVE-2024-4709.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-4698](https://cve.now/CVE-2024-4698.md): Testimonial Carousel For Elementor \<= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, uapp Testimonial Carousel For Elementor)
- [CVE-2024-2772](https://cve.now/CVE-2024-2772.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-2782](https://cve.now/CVE-2024-2782.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.16 - Missing Authorization to Setting Manipulation (CVSS 7.5, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-2771](https://cve.now/CVE-2024-2771.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation (CVSS 9.8, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-3812](https://cve.now/CVE-2024-3812.md): Salient Core \<= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 7.5, ThemeNectar Salient Core)
- [CVE-2024-3810](https://cve.now/CVE-2024-3810.md): Salient Shortcodes \<= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, ThemeNectar Salient Shortcodes)
- [CVE-2024-3811](https://cve.now/CVE-2024-3811.md): Salient Shortcodes \<= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ThemeNectar Salient Shortcodes)
- [CVE-2024-4849](https://cve.now/CVE-2024-4849.md): WordPress Automatic \<= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter (CVSS 6.4, ValvePress WordPress Automatic Plugin)
- [CVE-2024-4891](https://cve.now/CVE-2024-4891.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2024-3714](https://cve.now/CVE-2024-3714.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-4374](https://cve.now/CVE-2024-4374.md): DethemeKit For Elementor \<= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, DethemeKit for Elementor)
- [CVE-2024-4865](https://cve.now/CVE-2024-4865.md): Happy Addons for Elementor \<= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \_id Parameter (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-4264](https://cve.now/CVE-2024-4264.md): Remote Code Execution in berriai/litellm (CVSS 9.8, berriai/litellm · litellm)
- [CVE-2024-36048](https://cve.now/CVE-2024-36048.md): QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.