# CVEs published 2024-05-23

118 CVEs were published on May 23, 2024: 17 critical, 40 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-5279](https://cve.now/CVE-2024-5279.md): Qiwen Netdisk File Rename cross site scripting (CVSS 5.3, Qiwen Netdisk)
- [CVE-2024-5247](https://cve.now/CVE-2024-5247.md): NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR ProSAFE Network Management System)
- [CVE-2024-5246](https://cve.now/CVE-2024-5246.md): NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR ProSAFE Network Management System)
- [CVE-2024-5245](https://cve.now/CVE-2024-5245.md): NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability (CVSS 7.8, NETGEAR ProSAFE Network Management System)
- [CVE-2024-5244](https://cve.now/CVE-2024-5244.md): TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability (CVSS 5.0, TP-Link Omada ER605)
- [CVE-2024-5243](https://cve.now/CVE-2024-5243.md): TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, TP-Link Omada ER605)
- [CVE-2024-5242](https://cve.now/CVE-2024-5242.md): TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, TP-Link Omada ER605)
- [CVE-2024-5228](https://cve.now/CVE-2024-5228.md): TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, TP-Link Omada ER605)
- [CVE-2024-5227](https://cve.now/CVE-2024-5227.md): TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability (CVSS 7.5, TP-Link Omada ER605)
- [CVE-2024-5299](https://cve.now/CVE-2024-5299.md): D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability (CVSS 8.8, D-Link D-View)
- [CVE-2024-5298](https://cve.now/CVE-2024-5298.md): D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability (CVSS 8.8, D-Link D-View)
- [CVE-2024-5297](https://cve.now/CVE-2024-5297.md): D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability (CVSS 8.8, D-Link D-View)
- [CVE-2024-5296](https://cve.now/CVE-2024-5296.md): D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability (CVSS 9.8, D-Link D-View)
- [CVE-2024-5295](https://cve.now/CVE-2024-5295.md): D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability (CVSS 8.8, D-Link G416)
- [CVE-2024-5294](https://cve.now/CVE-2024-5294.md): D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability (CVSS 4.3, D-Link DIR-3040)
- [CVE-2024-5293](https://cve.now/CVE-2024-5293.md): D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, D-Link DIR-2640)
- [CVE-2024-5292](https://cve.now/CVE-2024-5292.md): D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.3, D-Link Network Assistant)
- [CVE-2024-5291](https://cve.now/CVE-2024-5291.md): D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability (CVSS 8.8, D-Link DIR-2150)
- [CVE-2024-5201](https://cve.now/CVE-2024-5201.md): Dimensions RM - Privilege Escalation (CVSS 8.8, OpenText Dimensions RM)
- [CVE-2024-5202](https://cve.now/CVE-2024-5202.md): Dimensions RM - Arbitrary File Read (CVSS 7.7, OpenText Dimensions RM)
- [CVE-2024-31843](https://cve.now/CVE-2024-31843.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 4.1)
- [CVE-2024-35375](https://cve.now/CVE-2024-35375.md): There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS (CVSS 9.8)
- [CVE-2024-35079](https://cve.now/CVE-2024-35079.md): An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading (CVSS 9.8)
- [CVE-2024-35080](https://cve.now/CVE-2024-35080.md): An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a craft (CVSS 9.8)
- [CVE-2024-35570](https://cve.now/CVE-2024-35570.md): An arbitrary file upload vulnerability in the component \\controller\\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute (CVSS 9.8)
- [CVE-2024-35091](https://cve.now/CVE-2024-35091.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml. (CVSS 9.8)
- [CVE-2024-35081](https://cve.now/CVE-2024-35081.md): LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload metho (CVSS 7.5)
- [CVE-2024-35086](https://cve.now/CVE-2024-35086.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml . (CVSS 9.8)
- [CVE-2024-35082](https://cve.now/CVE-2024-35082.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml. (CVSS 6.3)
- [CVE-2024-5143](https://cve.now/CVE-2024-5143.md): A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server (CVSS 6.8, Certain HP LaserJet Pro Printers)
- [CVE-2024-35084](https://cve.now/CVE-2024-35084.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml. (CVSS 9.8)
- [CVE-2024-35085](https://cve.now/CVE-2024-35085.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml. (CVSS 5.4)
- [CVE-2024-2301](https://cve.now/CVE-2024-2301.md): Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the de (CVSS 7.6, Certain HP LaserJet Pro Devices)
- [CVE-2024-35090](https://cve.now/CVE-2024-35090.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml. (CVSS 8.2)
- [CVE-2024-35083](https://cve.now/CVE-2024-35083.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml. (CVSS 8.8)
- [CVE-2024-34936](https://cve.now/CVE-2024-34936.md): A SQL injection vulnerability in /view/event1.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute (CVSS 8.6)
- [CVE-2024-34935](https://cve.now/CVE-2024-34935.md): A SQL injection vulnerability in /view/conversation\_history\_admin.php in Campcodes Complete Web-Based School Management System 1.0 allows an (CVSS 9.8)
- [CVE-2024-34934](https://cve.now/CVE-2024-34934.md): A SQL injection vulnerability in /view/emarks\_range\_grade\_update\_form.php in Campcodes Complete Web-Based School Management System 1.0 allow (CVSS 9.8)
- [CVE-2024-34933](https://cve.now/CVE-2024-34933.md): A SQL injection vulnerability in /model/update\_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to (CVSS 6.3)
- [CVE-2024-34932](https://cve.now/CVE-2024-34932.md): A SQL injection vulnerability in /model/update\_exam.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to e (CVSS 9.8)
- [CVE-2024-34931](https://cve.now/CVE-2024-34931.md): A SQL injection vulnerability in /model/update\_subject.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker t (CVSS 9.8)
- [CVE-2024-4365](https://cve.now/CVE-2024-4365.md): Advanced iFrame \<= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mdempfle Advanced iFrame)
- [CVE-2024-34930](https://cve.now/CVE-2024-34930.md): A SQL injection vulnerability in /model/all\_events1.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to exec (CVSS 5.3)
- [CVE-2024-34929](https://cve.now/CVE-2024-34929.md): A SQL injection vulnerability in /view/find\_friends.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to e (CVSS 9.8)
- [CVE-2024-34928](https://cve.now/CVE-2024-34928.md): A SQL injection vulnerability in /model/update\_subject\_routing.php in Campcodes Complete Web-Based School Management System 1.0 allows an at (CVSS 7.3)
- [CVE-2024-34927](https://cve.now/CVE-2024-34927.md): A SQL injection vulnerability in /model/update\_classroom.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker (CVSS 9.8)
- [CVE-2024-5084](https://cve.now/CVE-2024-5084.md): Hash Form – Drag & Drop Form Builder \<= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution (CVSS 9.8, hashthemes Hash Form – Drag & Drop Form Builder)
- [CVE-2024-5085](https://cve.now/CVE-2024-5085.md): Hash Form – Drag & Drop Form Builder \<= 1.1.0 - Unauthenticated PHP Object Injection (CVSS 8.1, hashthemes Hash Form – Drag & Drop Form Builder)
- [CVE-2024-35222](https://cve.now/CVE-2024-35222.md): iFrames Bypass Origin Checks for Tauri API Access Control (CVSS 5.9, tauri-apps tauri · tauri)
- [CVE-2024-5168](https://cve.now/CVE-2024-5168.md): Improper access control vulnerability in Prodys Quantum Audio codec (CVSS 9.8, Prodys Quantum Audio codec)
- [CVE-2024-35224](https://cve.now/CVE-2024-35224.md): Stored Cross-Site Scripting (XSS) in OpenProject (CVSS 7.6, opf openproject)
- [CVE-2024-4471](https://cve.now/CVE-2024-4471.md): 140+ Widgets | Best Addons For Elementor – FREE \<= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.0, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2024-1803](https://cve.now/CVE-2024-1803.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.12 - Insufficient Authorization Checks to Block Usual (CVSS 4.3, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-35197](https://cve.now/CVE-2024-35197.md): gix refs and paths with reserved Windows device names access the devices (CVSS 5.4, Byron gitoxide · gix-ref +6)
- [CVE-2024-34060](https://cve.now/CVE-2024-34060.md): Arbitrary File Write in IRIS EVTX Pipeline (CVSS 8.8, dfir-iris iris-evtx-module)
- [CVE-2024-28188](https://cve.now/CVE-2024-28188.md): jupyter-scheduler's endpoint is missing authentication (CVSS 5.3, jupyter-server jupyter-scheduler · jupyter-scheduler)
- [CVE-2024-26139](https://cve.now/CVE-2024-26139.md): OpenCTI Authenticated Privilege Escalation (CVSS 8.3, OpenCTI-Platform opencti · pycti)
- [CVE-2024-4378](https://cve.now/CVE-2024-4378.md): Premium Addons for Elementor \<= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-1814](https://cve.now/CVE-2024-1814.md): Spectra – WordPress Gutenberg Blocks \<= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block (CVSS 6.4, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2024-3997](https://cve.now/CVE-2024-3997.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2024-4575](https://cve.now/CVE-2024-4575.md): LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls\_search\_form Shortcode (CVSS 6.4, LayerSlider)
- [CVE-2024-1815](https://cve.now/CVE-2024-1815.md): Spectra – WordPress Gutenberg Blocks \<= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block (CVSS 6.4, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2023-6502](https://cve.now/CVE-2023-6502.md): Inefficient Regular Expression Complexity in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-7045](https://cve.now/CVE-2023-7045.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 5.4, GitLab)
- [CVE-2024-1947](https://cve.now/CVE-2024-1947.md): Improper Handling of Highly Compressed Data (Data Amplification) in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-5258](https://cve.now/CVE-2024-5258.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.4, GitLab)
- [CVE-2024-5165](https://cve.now/CVE-2024-5165.md): Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of Input (CVSS 6.5, Eclipse Foundation Eclipse Ditto · org.eclipse.ditto:ditto)
- [CVE-2024-4779](https://cve.now/CVE-2024-4779.md): Unlimited Elements for Elementor \<= 1.5.107 - Authenticated (Contributor+) SQL Injection via data\[post\_ids\]\[0\] (CVSS 8.8, unitecms Unlimited Elements For Elementor)
- [CVE-2024-2861](https://cve.now/CVE-2024-2861.md): ProfilePress \<= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget (CVSS 6.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-35186](https://cve.now/CVE-2024-35186.md): gix traversal outside working tree enables arbitrary code execution (CVSS 8.8, Byron gitoxide · gix-fs +6)
- [CVE-2024-35223](https://cve.now/CVE-2024-35223.md): Dapr API Token Exposure (CVSS 5.3, dapr · github.com/dapr/dapr)
- [CVE-2024-5264](https://cve.now/CVE-2024-5264.md): Network Key Transfer with AES KHT vulnerability in Luna EFT (CVSS 5.9, Thales Luna EFT)
- [CVE-2024-30279](https://cve.now/CVE-2024-30279.md): ZDI-CAN-22887: Adobe Acrobat Reader DC JPEG2000 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-30280](https://cve.now/CVE-2024-30280.md): ZDI-CAN-22867: Adobe Acrobat Pro DC AcroForm Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-32969](https://cve.now/CVE-2024-32969.md): vantage6 collaboration admins can extend their influence by expanding the collaboration (CVSS 2.7, vantage6)
- [CVE-2024-4706](https://cve.now/CVE-2024-4706.md): WordPress + Microsoft Office 365 / Azure AD | LOGIN \<= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode (CVSS 6.4, WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION)
- [CVE-2024-36013](https://cve.now/CVE-2024-36013.md): Bluetooth: L2CAP: Fix slab-use-after-free in l2cap\_connect() (CVSS 8.8, Linux)
- [CVE-2024-36012](https://cve.now/CVE-2024-36012.md): Bluetooth: msft: fix slab-use-after-free in msft\_do\_close() (CVSS 7.8, Linux)
- [CVE-2024-36011](https://cve.now/CVE-2024-36011.md): Bluetooth: HCI: Fix potential null-ptr-deref (CVSS 5.5, Linux)
- [CVE-2024-2874](https://cve.now/CVE-2024-2874.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-5241](https://cve.now/CVE-2024-5241.md): Huashi Private Cloud CDN Live Streaming Acceleration Server ipconfig\_new.php os command injection (CVSS 5.1, Huashi Private Cloud CDN Live Streaming Acceleration Server)
- [CVE-2024-2038](https://cve.now/CVE-2024-2038.md): Visual Website Collaboration, Feedback & Project Management – Atarim \<= 3.22.6 - Hardcoded Credentials (CVSS 7.5, wpfeedback Atarim – Visual Feedback, Review & AI Collaborat…)
- [CVE-2024-4043](https://cve.now/CVE-2024-4043.md): WP Ultimate Post Grid \<= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode (CVSS 6.4, brechtvds WP Ultimate Post Grid)
- [CVE-2024-3648](https://cve.now/CVE-2024-3648.md): ShareThis Share Buttons \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons Shortcode (CVSS 6.4, ShareThis Share Buttons)
- [CVE-2024-5240](https://cve.now/CVE-2024-5240.md): Campcodes Complete Web-Based School Management System unread\_msg.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4835](https://cve.now/CVE-2024-4835.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab)
- [CVE-2024-5239](https://cve.now/CVE-2024-5239.md): Campcodes Complete Web-Based School Management System timetable\_update\_form.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4399](https://cve.now/CVE-2024-4399.md): CAS \<= 1.0.0 - Unauthenticated SSRF (CVSS 9.1, cas)
- [CVE-2024-4388](https://cve.now/CVE-2024-4388.md): CAS \<= 1.0.0 - Unauthenticated Arbitrary File Access (CVSS 7.5, cas)
- [CVE-2024-3920](https://cve.now/CVE-2024-3920.md): Flattr \<= 1.2.2 - Admin+ Stored XSS (CVSS 3.5, Flattr)
- [CVE-2024-3918](https://cve.now/CVE-2024-3918.md): Pet Manager \<= 1.4 - Contributor+ Stored XSS (CVSS 4.8, Pet Manager)
- [CVE-2024-3917](https://cve.now/CVE-2024-3917.md): Pet Manager \<= 1.4 - Reflected XSS (CVSS 6.1, Pet Manager)
- [CVE-2024-3594](https://cve.now/CVE-2024-3594.md): IDonate \<= 1.9.0 - Admin+ Stored XSS (CVSS 8.7, IDonate)
- [CVE-2024-2220](https://cve.now/CVE-2024-2220.md): Button contact VR \<= 4.7 - Admin+ Stored XSS (CVSS 3.5, Button contact VR)
- [CVE-2024-5177](https://cve.now/CVE-2024-5177.md): Hash Elements \<= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets (CVSS 6.4, hashthemes Hash Elements)
- [CVE-2024-3711](https://cve.now/CVE-2024-3711.md): Brizy – Page Builder \<= 2.4.43 - Missing Authorization (CVSS 4.3, themefusecom Brizy – Page Builder)
- [CVE-2024-4347](https://cve.now/CVE-2024-4347.md): WP Fastest Cache \<= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion (CVSS 7.2, emrevona WP Fastest Cache – WordPress Cache Plugin)
- [CVE-2024-3626](https://cve.now/CVE-2024-3626.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.17 - Missing Authorization (CVSS 4.3, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-5238](https://cve.now/CVE-2024-5238.md): Campcodes Complete Web-Based School Management System timetable\_insert\_form.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5237](https://cve.now/CVE-2024-5237.md): Campcodes Complete Web-Based School Management System timetable\_grade\_wise.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5236](https://cve.now/CVE-2024-5236.md): Campcodes Complete Web-Based School Management System teacher\_salary\_invoice1.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5235](https://cve.now/CVE-2024-5235.md): Campcodes Complete Web-Based School Management System teacher\_salary\_invoice.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5234](https://cve.now/CVE-2024-5234.md): Campcodes Complete Web-Based School Management System teacher\_salary\_history1.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5233](https://cve.now/CVE-2024-5233.md): Campcodes Complete Web-Based School Management System teacher\_salary\_details3.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4662](https://cve.now/CVE-2024-4662.md): Oxygen Builder \<= 4.8.2 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, Oxygen Builder)
- [CVE-2023-6325](https://cve.now/CVE-2023-6325.md): RomethemeForm For Elementor \<= 1.1.5 - Missing Authorization via export\_entries, rtformnewform, and rtformupdate (CVSS 5.3, rometheme RTMForm Builder)
- [CVE-2024-4431](https://cve.now/CVE-2024-4431.md): LA-Studio Element Kit for Elementor \<= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, choijun LA-Studio Element Kit for Elementor)
- [CVE-2024-5232](https://cve.now/CVE-2024-5232.md): Campcodes Complete Web-Based School Management System teacher\_salary\_details2.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5231](https://cve.now/CVE-2024-5231.md): Campcodes Complete Web-Based School Management System teacher\_salary\_details.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4895](https://cve.now/CVE-2024-4895.md): wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin \<= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import (CVSS 4.7, wpDataTables – WordPress Data Table, Dynamic Tables & Table…)
- [CVE-2024-5230](https://cve.now/CVE-2024-5230.md): EnvaySoft FleetCart information disclosure (CVSS 6.9, EnvaySoft FleetCart)
- [CVE-2024-4978](https://cve.now/CVE-2024-4978.md): Malicious Code in Justice AV Solutions (JAVS) Viewer (CVSS 8.4, KEV, Justice AV Solutions Viewer)
- [CVE-2024-3201](https://cve.now/CVE-2024-3201.md): WP DSGVO Tools (GDPR) \<= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, legalweb WP DSGVO Tools)
- [CVE-2024-3065](https://cve.now/CVE-2024-3065.md): PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode \<= 1.7 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, mohsinrasool PayPal Pay Now, Buy Now, Donation and Cart But…)
- [CVE-2023-6844](https://cve.now/CVE-2023-6844.md): iframe \<= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 5.0, webvitaly iframe)
- [CVE-2024-4783](https://cve.now/CVE-2024-4783.md): jQuery T(-) Countdown Widget \<= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode (CVSS 6.4, baden03 jQuery T(-) Countdown Widget)
- [CVE-2024-1855](https://cve.now/CVE-2024-1855.md): WPCafe \<= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery (CVSS 5.3, arraytics WPCafe – Restaurant Menu, Online Food Ordering &…)
- [CVE-2024-4486](https://cve.now/CVE-2024-4486.md): Awesome Contact Form7 for Elementor \<= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget (CVSS 6.4, rafiul17 Awesome Contact Form7 for Elementor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.