# CVEs published 2024-06-21

137 CVEs were published on June 21, 2024: 11 critical, 26 high. Days are UTC.

- [CVE-2024-6120](https://cve.now/CVE-2024-6120.md): Sparkle Demo Importer \<= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Import (CVSS 6.5, sparklewpthemes Sparkle Demo Importer)
- [CVE-2020-27352](https://cve.now/CVE-2020-27352.md): When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result s (CVSS 9.3, Canonical snapd)
- [CVE-2023-37898](https://cve.now/CVE-2023-37898.md): Safe mode Cross-site Scripting (XSS) vulnerability in Joplin (CVSS 8.2, laurent22 joplin)
- [CVE-2023-38506](https://cve.now/CVE-2023-38506.md): Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin (CVSS 8.2, laurent22 joplin)
- [CVE-2023-39517](https://cve.now/CVE-2023-39517.md): Cross site scripting (XSS) when clicking on an untrusted \`\<map\>\` link in Joplin (CVSS 8.2, laurent22 joplin)
- [CVE-2023-45673](https://cve.now/CVE-2023-45673.md): Arbitrary code execution on click of PDF links in Joplin (CVSS 8.9, laurent22 joplin)
- [CVE-2024-6241](https://cve.now/CVE-2024-6241.md): Pear Admin Boot getDictItems sql injection (CVSS 5.3, Pear Admin Boot)
- [CVE-2024-35781](https://cve.now/CVE-2024-35781.md): WordPress Word Balloon plugin \<= 4.21.1 - Local File Inclusion vulnerability (CVSS 6.5, YAHMAN Word Balloon)
- [CVE-2024-35778](https://cve.now/CVE-2024-35778.md): WordPress Slideshow SE plugin \<= 2.5.17 - Auth. Limited Local File Inclusion vulnerability (CVSS 6.5, John West Slideshow SE)
- [CVE-2024-35767](https://cve.now/CVE-2024-35767.md): WordPress Squeeze plugin \<= 1.4 - Arbitrary File Upload vulnerability (CVSS 9.1, Bogdan Bendziukov Squeeze)
- [CVE-2023-38389](https://cve.now/CVE-2023-38389.md): WordPress Jupiter X Core plugin \<= 3.3.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, Artbees JupiterX Core)
- [CVE-2022-44593](https://cve.now/CVE-2022-44593.md): WordPress Solid Security plugin \<= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerability (CVSS 3.7, SolidWP Solid Security)
- [CVE-2022-44587](https://cve.now/CVE-2022-44587.md): WordPress WP 2FA plugin \<= 2.6.3 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, WP 2FA)
- [CVE-2022-38055](https://cve.now/CVE-2022-38055.md): WordPress wpForo Forum plugin \<= 2.0.9 - Auth. HTML Injection vulnerability (CVSS 4.3, gVectors Team wpForo Forum)
- [CVE-2023-45197](https://cve.now/CVE-2023-45197.md): Adminer and AdminerEvo vulnerable to directory traversal and file upload (CVSS 9.2, Adminer · AdminerEvo)
- [CVE-2024-37118](https://cve.now/CVE-2024-37118.md): WordPress Uncanny Automator Pro plugin \<= 5.3 - Cross Site Request Forgery (CSRF) Leading to License Settings Reset vulnerability (CVSS 5.4, Uncanny Owl Uncanny Automator Pro)
- [CVE-2024-37198](https://cve.now/CVE-2024-37198.md): WordPress Digital Newspaper theme \<= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, blazethemes Digital Newspaper)
- [CVE-2024-37212](https://cve.now/CVE-2024-37212.md): WordPress AliExpress Dropshipping with AliNext Lite plugin \<= 3.3.5 - CSRF to PHP Object Injection vulnerability (CVSS 8.3, Ali2Woo Lite)
- [CVE-2024-37227](https://cve.now/CVE-2024-37227.md): WordPress Newsletters plugin \<= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tribulant Newsletters)
- [CVE-2024-37230](https://cve.now/CVE-2024-37230.md): WordPress Book Landing Page theme \<= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rara Theme Book Landing Page)
- [CVE-2023-51375](https://cve.now/CVE-2023-51375.md): WordPress EmbedPress plugin \<= 3.8.3 - Broken Access Control vulnerability (CVSS 4.3, WPDeveloper EmbedPress)
- [CVE-2022-45803](https://cve.now/CVE-2022-45803.md): WordPress Gutenberg Forms plugin \<= 2.2.8.3 - Auth. Broken Access Control vulnerability (CVSS 6.5, Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg…)
- [CVE-2024-6240](https://cve.now/CVE-2024-6240.md): Improper privilege management vulnerability in Parallels Desktop (CVSS 7.7, Parallels Desktop)
- [CVE-2022-43453](https://cve.now/CVE-2022-43453.md): WordPress WP Tools plugin \<= 3.41 - Auth. Broken Access Control vulnerability (CVSS 8.8, Bill Minozzi WP Tools)
- [CVE-2024-6239](https://cve.now/CVE-2024-6239.md): Poppler: pdfinfo: crash in broken documents when using -dests parameter (CVSS 7.5, poppler · Red Hat Enterprise Linux)
- [CVE-2024-35770](https://cve.now/CVE-2024-35770.md): WordPress Vimeography plugin \<= 2.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin)
- [CVE-2024-35771](https://cve.now/CVE-2024-35771.md): WordPress Customizr theme \<= 4.4.21 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, presscustomizr Customizr)
- [CVE-2024-35772](https://cve.now/CVE-2024-35772.md): WordPress Hueman theme \<= 3.7.24 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, presscustomizr Hueman)
- [CVE-2024-35776](https://cve.now/CVE-2024-35776.md): WordPress phpinfo() WP plugin \<= 5.0 - Unauthenticated Data Exposure vulnerability (CVSS 5.3, Exeebit phpinfo() WP)
- [CVE-2024-5059](https://cve.now/CVE-2024-5059.md): WordPress Event Monster Plugin \<= 1.4.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, A WP Life Event Management Tickets Booking)
- [CVE-2024-35757](https://cve.now/CVE-2024-35757.md): WordPress Easy Age Verify plugin \<= 1.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, 5 Star Plugins Easy Age Verify)
- [CVE-2024-35758](https://cve.now/CVE-2024-35758.md): WordPress Interface theme \<= 3.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Theme Horse Interface)
- [CVE-2024-35759](https://cve.now/CVE-2024-35759.md): WordPress WP Job Portal plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wpjobportal WP Job Portal)
- [CVE-2024-35760](https://cve.now/CVE-2024-35760.md): WordPress WP Job Portal plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wpjobportal WP Job Portal)
- [CVE-2024-35761](https://cve.now/CVE-2024-35761.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2024-35762](https://cve.now/CVE-2024-35762.md): WordPress Serious Slider plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Cryout Creations Serious Slider)
- [CVE-2024-35763](https://cve.now/CVE-2024-35763.md): WordPress Excellent theme \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Theme Freesia Excellent)
- [CVE-2024-35764](https://cve.now/CVE-2024-35764.md): WordPress Church Admin plugin \<= 4.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, andy\_moyle Church Admin)
- [CVE-2024-35766](https://cve.now/CVE-2024-35766.md): WordPress WPPizza – A Restaurant Plugin plugin \<= 3.18.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ollybach WPPizza)
- [CVE-2024-35768](https://cve.now/CVE-2024-35768.md): WordPress Page Builder: Live Composer plugin \<= 2.1.22 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Live Composer Team Page Builder: Live Composer)
- [CVE-2024-35769](https://cve.now/CVE-2024-35769.md): WordPress Slideshow SE plugin \<= 2.5.17 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, John West Slideshow SE)
- [CVE-2024-35774](https://cve.now/CVE-2024-35774.md): WordPress DImage 360 plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, D’arteweb DImage)
- [CVE-2024-35779](https://cve.now/CVE-2024-35779.md): WordPress Page Builder: Live Composer plugin \<= 1.5.42 - Contributor+ Shortcode Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Live Composer Team Page Builder: Live Composer)
- [CVE-2024-5058](https://cve.now/CVE-2024-5058.md): WordPress Typing Text plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Typing Text)
- [CVE-2024-36481](https://cve.now/CVE-2024-36481.md): tracing/probes: fix error check in parse\_btf\_field() (no CVSS, Linux)
- [CVE-2024-36477](https://cve.now/CVE-2024-36477.md): tpm\_tis\_spi: Account for SPI header when allocating TPM SPI xfer buffer (CVSS 7.8, Linux)
- [CVE-2024-36288](https://cve.now/CVE-2024-36288.md): SUNRPC: Fix loop termination condition in gss\_free\_in\_token\_pages() (CVSS 9.8, Linux)
- [CVE-2024-34777](https://cve.now/CVE-2024-34777.md): dma-mapping: benchmark: fix node id validation (no CVSS, Linux)
- [CVE-2024-39277](https://cve.now/CVE-2024-39277.md): dma-mapping: benchmark: handle NUMA\_NO\_NODE correctly (CVSS 7.8, Linux)
- [CVE-2024-38780](https://cve.now/CVE-2024-38780.md): dma-buf/sw-sync: don't enable IRQ from sync\_print\_obj() (no CVSS, Linux)
- [CVE-2024-38662](https://cve.now/CVE-2024-38662.md): bpf: Allow delete from sockmap/sockhash only if update is allowed (no CVSS, Linux)
- [CVE-2024-38659](https://cve.now/CVE-2024-38659.md): enic: Validate length of nl attributes in enic\_set\_vf\_port (CVSS 7.3, Linux)
- [CVE-2024-3036](https://cve.now/CVE-2024-3036.md): Communication DoS vulnerability (CVSS 6.9, ABB 800xA Base)
- [CVE-2024-38637](https://cve.now/CVE-2024-38637.md): greybus: lights: check return of get\_channel\_from\_mode (no CVSS, Linux)
- [CVE-2024-38636](https://cve.now/CVE-2024-38636.md): f2fs: multidev: fix to recognize valid zero block address (no CVSS, Linux)
- [CVE-2024-38635](https://cve.now/CVE-2024-38635.md): soundwire: cadence: fix invalid PDI offset (CVSS 7.8, Linux)
- [CVE-2024-38634](https://cve.now/CVE-2024-38634.md): serial: max3100: Lock port-\>lock when calling uart\_handle\_cts\_change() (no CVSS, Linux)
- [CVE-2024-38633](https://cve.now/CVE-2024-38633.md): serial: max3100: Update uart\_driver\_registered on driver removal (no CVSS, Linux)
- [CVE-2024-38632](https://cve.now/CVE-2024-38632.md): vfio/pci: fix potential memory leak in vfio\_intx\_enable() (no CVSS, Linux)
- [CVE-2024-38631](https://cve.now/CVE-2024-38631.md): iio: adc: PAC1934: fix accessing out of bounds array index (no CVSS, Linux)
- [CVE-2024-38630](https://cve.now/CVE-2024-38630.md): watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt\_trigger (no CVSS, Linux)
- [CVE-2024-38629](https://cve.now/CVE-2024-38629.md): dmaengine: idxd: Avoid unnecessary destruction of file\_ida (no CVSS, Linux)
- [CVE-2024-38628](https://cve.now/CVE-2024-38628.md): usb: gadget: u\_audio: Fix race condition use of controls after free during gadget unbind. (CVSS 7.8, Linux)
- [CVE-2024-38627](https://cve.now/CVE-2024-38627.md): stm class: Fix a double free in stm\_register\_device() (no CVSS, Linux)
- [CVE-2024-38626](https://cve.now/CVE-2024-38626.md): fuse: clear FR\_SENT when re-adding requests into pending list (CVSS 7.8, Linux)
- [CVE-2024-38625](https://cve.now/CVE-2024-38625.md): fs/ntfs3: Check 'folio' pointer for NULL (no CVSS, Linux)
- [CVE-2024-38624](https://cve.now/CVE-2024-38624.md): fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow (no CVSS, Linux)
- [CVE-2024-38623](https://cve.now/CVE-2024-38623.md): fs/ntfs3: Use variable length array instead of fixed size (CVSS 7.8, Linux)
- [CVE-2024-38622](https://cve.now/CVE-2024-38622.md): drm/msm/dpu: Add callback function pointer check before its call (no CVSS, Linux)
- [CVE-2024-38621](https://cve.now/CVE-2024-38621.md): media: stk1160: fix bounds checking in stk1160\_copy\_video() (no CVSS, Linux)
- [CVE-2024-38390](https://cve.now/CVE-2024-38390.md): drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails (no CVSS, Linux)
- [CVE-2024-38388](https://cve.now/CVE-2024-38388.md): ALSA: hda/cs\_dsp\_ctl: Use private\_free for control cleanup (CVSS 7.8, Linux)
- [CVE-2024-38381](https://cve.now/CVE-2024-38381.md): nfc: nci: Fix uninit-value in nci\_rx\_work (CVSS 8.8, Linux)
- [CVE-2024-37356](https://cve.now/CVE-2024-37356.md): tcp: Fix shift-out-of-bounds in dctcp\_update\_alpha(). (no CVSS, Linux)
- [CVE-2024-36489](https://cve.now/CVE-2024-36489.md): tls: fix missing memory barrier in tls\_init (no CVSS, Linux)
- [CVE-2024-36484](https://cve.now/CVE-2024-36484.md): net: relax socket state check at accept time. (no CVSS, Linux)
- [CVE-2024-36478](https://cve.now/CVE-2024-36478.md): null\_blk: fix null-ptr-dereference while configuring 'power' and 'submit\_queues' (no CVSS, Linux)
- [CVE-2024-36286](https://cve.now/CVE-2024-36286.md): netfilter: nfnetlink\_queue: acquire rcu\_read\_lock() in instance\_destroy\_rcu() (CVSS 7.8, Linux)
- [CVE-2024-36281](https://cve.now/CVE-2024-36281.md): net/mlx5: Use mlx5\_ipsec\_rx\_status\_destroy to correctly delete status rules (no CVSS, Linux)
- [CVE-2024-36270](https://cve.now/CVE-2024-36270.md): netfilter: tproxy: bail out if IP has been disabled on the device (no CVSS, Linux)
- [CVE-2024-36244](https://cve.now/CVE-2024-36244.md): net/sched: taprio: extend minimum interval restriction to entire cycle too (no CVSS, Linux)
- [CVE-2024-33621](https://cve.now/CVE-2024-33621.md): ipvlan: Dont Use skb-\>sk in ipvlan\_process\_v{4,6}\_outbound (no CVSS, Linux)
- [CVE-2024-33619](https://cve.now/CVE-2024-33619.md): efi: libstub: only free priv.runtime\_map when allocated (CVSS 7.8, Linux)
- [CVE-2024-31076](https://cve.now/CVE-2024-31076.md): genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (no CVSS, Linux)
- [CVE-2023-52884](https://cve.now/CVE-2023-52884.md): Input: cyapa - add missing input core locking to suspend/resume functions (CVSS 4.4, Linux)
- [CVE-2024-6027](https://cve.now/CVE-2024-6027.md): Themify - WooCommerce Product Filter \<= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter (CVSS 9.8, themifyme Themify – WooCommerce Product Filter)
- [CVE-2024-31890](https://cve.now/CVE-2024-31890.md): IBM i privilege escalation (CVSS 7.8, IBM i)
- [CVE-2024-5859](https://cve.now/CVE-2024-5859.md): Appointment Booking and Online Scheduling \<= 4.4.2 - Reflected Cross-Site Scripting (CVSS 6.1, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2024-5945](https://cve.now/CVE-2024-5945.md): WP SVG Images \<= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG (CVSS 6.4, shortpixel WP SVG Images)
- [CVE-2024-6225](https://cve.now/CVE-2024-6225.md): Amelia \<= 1.1.5 & Amelia (Pro) \<= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2024-2003](https://cve.now/CVE-2024-2003.md): Local Privilege Escalation in Quarantine of ESET products for Windows (CVSS 7.3, ESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +11)
- [CVE-2024-5191](https://cve.now/CVE-2024-5191.md): Branda – White Label WordPress, Custom Login Page Customizer \<= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 6.4, wpmudev Branda – White Label & Branding, Free Login Page Cu…)
- [CVE-2024-5639](https://cve.now/CVE-2024-5639.md): User Profile Picture \<= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update (CVSS 4.3, cozmoslabs User Profile Picture)
- [CVE-2024-5448](https://cve.now/CVE-2024-5448.md): PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode \<= 1.7 - Contributor+ Stored XSS (CVSS 6.1, PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode)
- [CVE-2024-5447](https://cve.now/CVE-2024-5447.md): PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode \<= 1.7 - Admin+ Stored XSS (CVSS 5.4, PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode)
- [CVE-2024-4970](https://cve.now/CVE-2024-4970.md): Widget Bundle \<= 2.0.0 - Admin+ Stored XSS (CVSS 6.1, Widget Bundle)
- [CVE-2024-4969](https://cve.now/CVE-2024-4969.md): Widget Bundle \<= 2.0.0 - Widget Disable/Enable via CSRF (CVSS 4.3, Widget Bundle)
- [CVE-2024-4755](https://cve.now/CVE-2024-4755.md): Google CSE \<= 1.0.7 - Admin+ Stored XSS (CVSS 4.0, Google CSE)
- [CVE-2024-4616](https://cve.now/CVE-2024-4616.md): Widget Bundle \<= 2.0.0 - Unauthencated Reflected XSS (CVSS 6.1, Widget Bundle)
- [CVE-2024-4477](https://cve.now/CVE-2024-4477.md): WP Logs Book \<= 1.0.1 - Unauthenticated Stored XSS (CVSS 4.3, WP Logs Book)
- [CVE-2024-4475](https://cve.now/CVE-2024-4475.md): WP Logs Book \<= 1.0.1 - Log Clearing via CSRF (CVSS 4.3, WP Logs Book)
- [CVE-2024-4474](https://cve.now/CVE-2024-4474.md): WP Logs Book \<= 1.0.1 - Disable Logging via CSRF (CVSS 4.3, WP Logs Book)
- [CVE-2024-4384](https://cve.now/CVE-2024-4384.md): CSSable Countdown \<= 1.5 - Admin+ Stored XSS (CVSS 6.1, CSSable Countdown)
- [CVE-2024-4382](https://cve.now/CVE-2024-4382.md): CB (legacy) \<= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF (CVSS 4.3, CB)
- [CVE-2024-4381](https://cve.now/CVE-2024-4381.md): CB (legacy) \<= 0.9.4.18 - Admin+ Stored XSS (CVSS 4.8, CB)
- [CVE-2024-4377](https://cve.now/CVE-2024-4377.md): DOP Shortcodes \<= 1.2 - Contributor+ Stored XSS via Shortcode (CVSS 6.1, DOP Shortcodes)
- [CVE-2024-5756](https://cve.now/CVE-2024-5756.md): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \<= 5.7.23 - Unauthenticated SQL Injection via optin (CVSS 9.8, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-3961](https://cve.now/CVE-2024-3961.md): ConvertKit \<= 2.4.9 - Missing Authorization (CVSS 5.3, Kit (formerly ConvertKit) – Email Newsletter, Email Marketi…)
- [CVE-2024-5455](https://cve.now/CVE-2024-5455.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.6 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, posimyththemes The Plus Addons for Elementor Page Builder P…)
- [CVE-2023-3352](https://cve.now/CVE-2023-3352.md): Smush – Lazy Load Images, Optimize & Compress Images \<= 3.16.4 - Missing Authorization to Resmush List Deletion (CVSS 4.3, wpmudev Smush – Image Optimization, Compression, Lazy Load,…)
- [CVE-2024-1955](https://cve.now/CVE-2024-1955.md): Hide Dashboard Notifications \<= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification (CVSS 4.3, wprepublic Hide Dashboard Notifications)
- [CVE-2024-1639](https://cve.now/CVE-2024-1639.md): License Manager for WooCommerce \<= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure (CVSS 6.5, saadiqbal License Manager for WooCommerce)
- [CVE-2024-3610](https://cve.now/CVE-2024-3610.md): WP Child Theme Generator \<= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation (CVSS 5.3, wen-solutions WP Child Theme Generator)
- [CVE-2024-5503](https://cve.now/CVE-2024-5503.md): WP Blog Post Layouts \<= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion (CVSS 8.8, codevibrant WP Blog Post Layouts)
- [CVE-2024-5344](https://cve.now/CVE-2024-5344.md): The Plus Addons for Elementor Page Builder \<= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget (CVSS 6.1, posimyththemes The Plus Addons for Elementor Page Builder P…)
- [CVE-2024-6218](https://cve.now/CVE-2024-6218.md): itsourcecode Vehicle Management System busprofile.php sql injection (CVSS 6.9, itsourcecode Vehicle Management System)
- [CVE-2024-6217](https://cve.now/CVE-2024-6217.md): SourceCodester Food Ordering Management System user-router.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-6216](https://cve.now/CVE-2024-6216.md): SourceCodester Food Ordering Management System add-users.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-6215](https://cve.now/CVE-2024-6215.md): SourceCodester Food Ordering Management System view-ticket-admin.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-6214](https://cve.now/CVE-2024-6214.md): SourceCodester Food Ordering Management System add-item.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-6213](https://cve.now/CVE-2024-6213.md): SourceCodester Food Ordering Management System Login Panel login.php sql injection (CVSS 6.9, SourceCodester Food Ordering Management System)
- [CVE-2024-6212](https://cve.now/CVE-2024-6212.md): SourceCodester Simple Student Attendance System student\_form.php get\_student cross site scripting (CVSS 5.3, SourceCodester Simple Student Attendance System)
- [CVE-2012-6664](https://cve.now/CVE-2012-6664.md): Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read (CVSS 9.1)
- [CVE-2014-5470](https://cve.now/CVE-2014-5470.md): Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data (CVSS 9.8)
- [CVE-2021-47621](https://cve.now/CVE-2021-47621.md): ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks. (CVSS 7.5, io.github.classgraph:classgraph)
- [CVE-2022-42974](https://cve.now/CVE-2022-42974.md): In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting (XSS) a (CVSS 4.8)
- [CVE-2024-34452](https://cve.now/CVE-2024-34452.md): CMSimple\_XH 1.7.6 allows XSS by uploading a crafted SVG document. (CVSS 6.1)
- [CVE-2024-34989](https://cve.now/CVE-2024-34989.md): In the module RSI PDF/HTML catalog evolution (prestapdf) \<= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via \`PrestaPDFP (CVSS 9.8)
- [CVE-2024-35537](https://cve.now/CVE-2024-35537.md): TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers (CVSS 7.5)
- [CVE-2024-36532](https://cve.now/CVE-2024-36532.md): Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's t (CVSS 10.0)
- [CVE-2024-37654](https://cve.now/CVE-2024-37654.md): An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, (CVSS 6.1)
- [CVE-2024-37671](https://cve.now/CVE-2024-37671.md): Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via (CVSS 5.4)
- [CVE-2024-37672](https://cve.now/CVE-2024-37672.md): Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via (CVSS 5.4)
- [CVE-2024-37673](https://cve.now/CVE-2024-37673.md): Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via (CVSS 5.4)
- [CVE-2024-37675](https://cve.now/CVE-2024-37675.md): Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via (CVSS 5.4)
- [CVE-2024-38873](https://cve.now/CVE-2024-38873.md): An issue was discovered in the friendlycaptcha\_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. (CVSS 5.3, studiomitte/friendlycaptcha)
- [CVE-2024-38874](https://cve.now/CVE-2024-38874.md): An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. (CVSS 5.4, jweiland/events2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.