# CVEs published 2024-06-15

30 CVEs were published on June 15, 2024: 3 critical, 5 high. Days are UTC.

- [CVE-2024-6016](https://cve.now/CVE-2024-6016.md): itsourcecode Online Laundry Management System admin\_class.php sql injection (CVSS 5.3, itsourcecode Online Laundry Management System)
- [CVE-2024-6015](https://cve.now/CVE-2024-6015.md): itsourcecode Online House Rental System manage\_user.php sql injection (CVSS 5.3, itsourcecode Online House Rental System)
- [CVE-2024-6014](https://cve.now/CVE-2024-6014.md): itsourcecode Document Management System edithis.php sql injection (CVSS 5.3, itsourcecode Document Management System)
- [CVE-2024-6013](https://cve.now/CVE-2024-6013.md): itsourcecode Online Book Store admin\_delete.php sql injection (CVSS 5.3, itsourcecode Online Book Store)
- [CVE-2024-6009](https://cve.now/CVE-2024-6009.md): itsourcecode Event Calendar process.php regDelete sql injection (CVSS 5.3, itsourcecode Event Calendar)
- [CVE-2024-6008](https://cve.now/CVE-2024-6008.md): itsourcecode Online Book Store edit\_book.php sql injection (CVSS 5.3, itsourcecode Online Book Store)
- [CVE-2024-27275](https://cve.now/CVE-2024-27275.md): IBM i privilege escalation (CVSS 7.4, IBM i)
- [CVE-2024-31870](https://cve.now/CVE-2024-31870.md): IBM i information disclosure (CVSS 3.3, IBM i)
- [CVE-2024-6007](https://cve.now/CVE-2024-6007.md): Netentsec NS-ASG Application Security Gateway deleteiscgwrouteconf.php sql injection (CVSS 5.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-6006](https://cve.now/CVE-2024-6006.md): ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting (CVSS 5.1, ZKTeco ZKBio CVSecurity)
- [CVE-2024-5611](https://cve.now/CVE-2024-5611.md): Stratum – Elementor Widgets \<= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, jetmonsters Stratum Widgets for Elementor)
- [CVE-2024-6005](https://cve.now/CVE-2024-6005.md): ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting (CVSS 5.1, ZKTeco ZKBio CVSecurity)
- [CVE-2024-4095](https://cve.now/CVE-2024-4095.md): Collapse-O-Matic \<= 1.8.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, baden03 Collapse-O-Matic)
- [CVE-2024-4551](https://cve.now/CVE-2024-4551.md): Video Gallery – YouTube Playlist, Channel Gallery by YotuWP \<= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode (CVSS 6.4, Video Gallery – YouTube Playlist, Channel Gallery by YotuWP)
- [CVE-2024-2695](https://cve.now/CVE-2024-2695.md): Shariff Wrapper \<= 4.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, 3uu Shariff Wrapper)
- [CVE-2024-4258](https://cve.now/CVE-2024-4258.md): Video Gallery – YouTube Playlist, Channel Gallery by YotuWP \<= 1.3.13 - Unauthenticated Local File Inclusion (CVSS 9.8, Video Gallery – YouTube Playlist, Channel Gallery by YotuWP)
- [CVE-2024-5858](https://cve.now/CVE-2024-5858.md): Infographic Maker iList \<= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update (CVSS 4.3, quantumcloud AI Infographic Maker)
- [CVE-2024-3105](https://cve.now/CVE-2024-3105.md): Woody code snippets – Insert Header Footer Code, AdSense Ads \<= 2.5.0 -Authenticated (Contributor+) Remote Code Execution (CVSS 9.9, themeisle Woody Code Snippets – Insert PHP, CSS, JS, and He…)
- [CVE-2024-1399](https://cve.now/CVE-2024-1399.md): Restaurant Menu and Food Ordering \<= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, gloriafood Restaurant Menu – Food Ordering System – Table R…)
- [CVE-2024-5871](https://cve.now/CVE-2024-5871.md): WooCommerce - Social Login \<= 2.6.2 - Unauthenticated PHP Object Injection (CVSS 9.8, WPWeb WooCommerce - Social Login)
- [CVE-2024-5868](https://cve.now/CVE-2024-5868.md): WooCommerce - Social Login \<= 2.6.2 - Email Verification due to Insufficient Randomness (CVSS 6.5, WPWeb WooCommerce - Social Login)
- [CVE-2024-6000](https://cve.now/CVE-2024-6000.md): FooEvents for WooCommerce \<= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload (CVSS 7.1, FooEvents for WooCommerce)
- [CVE-2024-4479](https://cve.now/CVE-2024-4479.md): Jeg Elementor Kit \<= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2023-6696](https://cve.now/CVE-2023-6696.md): Popup Builder – Create highly converting, mobile friendly marketing popups \<= 4.3.1 - Missing Authorization and Nonce Exposure (CVSS 8.1, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2024-3813](https://cve.now/CVE-2024-3813.md): tagDiv Composer \<= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, tagDiv Composer)
- [CVE-2024-3815](https://cve.now/CVE-2024-3815.md): Newspaper \<= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta (CVSS 5.5, Newspaper - News & WooCommerce WordPress Theme)
- [CVE-2024-3814](https://cve.now/CVE-2024-3814.md): tagDiv Composer \<= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta (CVSS 5.5, tagDiv Composer)
- [CVE-2024-5263](https://cve.now/CVE-2024-5263.md): ElementsKit Elementor addons and Templates Library \<= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets (CVSS 6.4, wpmet ElementsKit Pro)
- [CVE-2024-2544](https://cve.now/CVE-2024-2544.md): Popup Builder \<= 4.3.0 - Missing Authorization in Multiple AJAX Actions (CVSS 7.4, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2024-38394](https://cve.now/CVE-2024-38394.md): Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying devic (CVSS 4.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.