# CVEs published 2024-05-26 47 CVEs were published on May 26, 2024: 0 critical, 2 high. Days are UTC. - [CVE-2024-5384](https://cve.now/CVE-2024-5384.md): SourceCodester Facebook News Feed Like index.php sql injection (CVSS 6.9, SourceCodester Facebook News Feed Like) - [CVE-2024-5383](https://cve.now/CVE-2024-5383.md): lakernote EasyAdmin upload cross site scripting (CVSS 5.3, lakernote EasyAdmin) - [CVE-2024-36056](https://cve.now/CVE-2024-36056.md): Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c40649 (CVSS 5.4) - [CVE-2024-36055](https://cve.now/CVE-2024-36055.md): Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write acc (CVSS 5.5) - [CVE-2024-36054](https://cve.now/CVE-2024-36054.md): Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory (and consequently ga (CVSS 7.4) - [CVE-2024-5381](https://cve.now/CVE-2024-5381.md): itsourcecode Student Information Management System view.php sql injection (CVSS 5.3, itsourcecode Student Information Management System) - [CVE-2024-5380](https://cve.now/CVE-2024-5380.md): jsy-1 short-url admin.php cross site scripting (CVSS 5.3, jsy-1 short-url) - [CVE-2024-4286](https://cve.now/CVE-2024-4286.md): Improper Neutralization of Special Elements in mintplex-labs/anything-llm (CVSS 4.9, mintplex-labs/anything-llm) - [CVE-2024-5379](https://cve.now/CVE-2024-5379.md): JFinalCMS template cross site scripting (CVSS 5.3, JFinalCMS) - [CVE-2024-34454](https://cve.now/CVE-2024-34454.md): Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a (CVSS 7.4) - [CVE-2024-5378](https://cve.now/CVE-2024-5378.md): SourceCodester School Intramurals Student Attendance Management System manage\_sy.php sql injection (CVSS 5.3, SourceCodester School Intramurals Student Attendance Manage…) - [CVE-2024-5377](https://cve.now/CVE-2024-5377.md): SourceCodester Vehicle Management System newvehicle.php unrestricted upload (CVSS 6.9, SourceCodester Vehicle Management System) - [CVE-2024-5376](https://cve.now/CVE-2024-5376.md): Kashipara College Management System view\_each\_faculty.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5375](https://cve.now/CVE-2024-5375.md): Kashipara College Management System submit\_student.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5374](https://cve.now/CVE-2024-5374.md): Kashipara College Management System submit\_new\_faculty.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5373](https://cve.now/CVE-2024-5373.md): Kashipara College Management System submit\_login.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5372](https://cve.now/CVE-2024-5372.md): Kashipara College Management System submit\_extracurricular\_activity.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5371](https://cve.now/CVE-2024-5371.md): Kashipara College Management System submit\_enroll\_student.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5370](https://cve.now/CVE-2024-5370.md): Kashipara College Management System submit\_enroll\_staff.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5369](https://cve.now/CVE-2024-5369.md): Kashipara College Management System submit\_admin.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5368](https://cve.now/CVE-2024-5368.md): Kashipara College Management System delete\_faculty.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5367](https://cve.now/CVE-2024-5367.md): Kashipara College Management System each\_extracurricula\_activities.php cross site scripting (CVSS 5.3, Kashipara College Management System) - [CVE-2024-5366](https://cve.now/CVE-2024-5366.md): SourceCodester Best House Rental Management System edit-cate.php sql injection (CVSS 5.3, SourceCodester Best House Rental Management System) - [CVE-2024-29215](https://cve.now/CVE-2024-29215.md): Slash commands run in channel without channel membership via playbook task commands (CVSS 4.3, Mattermost) - [CVE-2024-36255](https://cve.now/CVE-2024-36255.md): Post actions can run playbook checklist task commands (CVSS 5.7, Mattermost) - [CVE-2024-36241](https://cve.now/CVE-2024-36241.md): /playbook add slash command allows viewing arbitrary post contents (CVSS 3.1, Mattermost) - [CVE-2024-31859](https://cve.now/CVE-2024-31859.md): Member promoted to channel admin via playbooks run linking to channel (CVSS 4.3, Mattermost) - [CVE-2024-5270](https://cve.now/CVE-2024-5270.md): SAML to email switch possible when email signin is disabled (CVSS 4.3, Mattermost) - [CVE-2024-5272](https://cve.now/CVE-2024-5272.md): Run Details leak to guest via webhook event "custom\_playbooks\_playbook\_run\_updated" (CVSS 4.3, Mattermost) - [CVE-2024-32045](https://cve.now/CVE-2024-32045.md): Playbook run link to private channel grants channel access (CVSS 5.9, Mattermost) - [CVE-2024-34152](https://cve.now/CVE-2024-34152.md): Playbook Run Metadata leak to Guest (CVSS 4.3, Mattermost) - [CVE-2024-34029](https://cve.now/CVE-2024-34029.md): AD/LDAP Group Members Leak (CVSS 4.3, Mattermost) - [CVE-2024-5365](https://cve.now/CVE-2024-5365.md): SourceCodester Best House Rental Management System manage\_payment.php sql injection (CVSS 5.3, SourceCodester Best House Rental Management System) - [CVE-2024-5364](https://cve.now/CVE-2024-5364.md): SourceCodester Best House Rental Management System manage\_tenant.php sql injection (CVSS 5.3, SourceCodester Best House Rental Management System) - [CVE-2024-5363](https://cve.now/CVE-2024-5363.md): SourceCodester Best House Rental Management System manage\_user.php sql injection (CVSS 5.3, SourceCodester Best House Rental Management System) - [CVE-2024-5362](https://cve.now/CVE-2024-5362.md): SourceCodester Online Hospital Management System departmentDoctor.php sql injection (CVSS 6.9, SourceCodester Online Hospital Management System) - [CVE-2024-5361](https://cve.now/CVE-2024-5361.md): PHPGurukul Zoo Management System normal-bwdates-reports-details.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System) - [CVE-2024-5360](https://cve.now/CVE-2024-5360.md): PHPGurukul Zoo Management System foreigner-bwdates-reports-details.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System) - [CVE-2024-5359](https://cve.now/CVE-2024-5359.md): PHPGurukul Zoo Management System foreigner-search.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System) - [CVE-2024-5358](https://cve.now/CVE-2024-5358.md): PHPGurukul Zoo Management System normal-search.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System) - [CVE-2024-5357](https://cve.now/CVE-2024-5357.md): PHPGurukul Zoo Management System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Zoo Management System) - [CVE-2024-5356](https://cve.now/CVE-2024-5356.md): anji-plus AJ-Report testTransform;swagger-ui sql injection (CVSS 5.3, anji-plus AJ-Report) - [CVE-2024-5355](https://cve.now/CVE-2024-5355.md): anji-plus AJ-Report IGroovyHandler command injection (CVSS 5.3, anji-plus AJ-Report) - [CVE-2024-5354](https://cve.now/CVE-2024-5354.md): anji-plus AJ-Report detailByCode information disclosure (CVSS 5.3, anji-plus AJ-Report) - [CVE-2024-5353](https://cve.now/CVE-2024-5353.md): anji-plus AJ-Report ZIP File decompress path traversal (CVSS 5.3, anji-plus AJ-Report) - [CVE-2024-5352](https://cve.now/CVE-2024-5352.md): anji-plus AJ-Report validationRules deserialization (CVSS 5.3, anji-plus AJ-Report) - [CVE-2024-5351](https://cve.now/CVE-2024-5351.md): anji-plus AJ-Report Javascript getValueFromJs deserialization (CVSS 5.3, anji-plus AJ-Report) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-05-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.