# CVEs published 2024-06-22

22 CVEs were published on June 22, 2024: 1 critical, 5 high. Days are UTC.

- [CVE-2024-38319](https://cve.now/CVE-2024-38319.md): IBM Security SOAR code execution (CVSS 7.5, IBM Security SOAR)
- [CVE-2024-5443](https://cve.now/CVE-2024-5443.md): Remote Code Execution via Path Traversal in parisneo/lollms (CVSS 9.8, parisneo/lollms · lollms)
- [CVE-2024-6253](https://cve.now/CVE-2024-6253.md): itsourcecode Online Food Ordering System purchase.php sql injection (CVSS 6.9, itsourcecode Online Food Ordering System)
- [CVE-2024-6252](https://cve.now/CVE-2024-6252.md): Zorlan SkyCaiji Task cross site scripting (CVSS 5.1, Zorlan SkyCaiji)
- [CVE-2024-6251](https://cve.now/CVE-2024-6251.md): playSMS New Phonebook cross site scripting (CVSS 5.1, playSMS)
- [CVE-2024-38379](https://cve.now/CVE-2024-38379.md): Apache Allura: Stored authenticated XSS (CVSS 4.8, Apache Software Foundation Apache Allura)
- [CVE-2024-3593](https://cve.now/CVE-2024-3593.md): UberMenu \<= 3.8.3 - Cross-Site Request Forgery to Settings Reset (CVSS 7.2, SevenSpark UberMenu)
- [CVE-2024-5596](https://cve.now/CVE-2024-5596.md): ARMember Premium \<= 6.7 - Cross-Site Request Forgery via multiple functions (CVSS 6.3, ARMember Premium – Membership Plugin, Content Restriction,…)
- [CVE-2024-4940](https://cve.now/CVE-2024-4940.md): Open Redirect in gradio-app/gradio (CVSS 5.4, gradio-app/gradio · gradio)
- [CVE-2024-21516](https://cve.now/CVE-2024-21516.md): This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. (CVSS 2.1, opencart/opencart)
- [CVE-2024-21519](https://cve.now/CVE-2024-21519.md): This affects versions of the package opencart/opencart from 4.0.0.0. (CVSS 6.6, opencart/opencart)
- [CVE-2024-21514](https://cve.now/CVE-2024-21514.md): This affects versions of the package opencart/opencart from 0.0.0. (CVSS 7.4, opencart/opencart)
- [CVE-2024-21518](https://cve.now/CVE-2024-21518.md): This affects versions of the package opencart/opencart from 4.0.0.0. (CVSS 7.2, opencart/opencart)
- [CVE-2024-21517](https://cve.now/CVE-2024-21517.md): This affects versions of the package opencart/opencart from 4.0.0.0. (CVSS 2.1, opencart/opencart)
- [CVE-2024-21515](https://cve.now/CVE-2024-21515.md): This affects versions of the package opencart/opencart from 4.0.0.0. (CVSS 2.1, opencart/opencart)
- [CVE-2024-4874](https://cve.now/CVE-2024-4874.md): Bricks Builder \<= 1.9.8 - Insecure Direct Object Reference (CVSS 4.3, BricksBuilder Bricks Builder)
- [CVE-2024-5965](https://cve.now/CVE-2024-5965.md): Mosaic \<= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (CVSS 6.4, wildweblab Mosaic)
- [CVE-2024-5966](https://cve.now/CVE-2024-5966.md): Grey Opaque \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode (CVSS 6.4, ppfeufer Grey Opaque)
- [CVE-2024-4313](https://cve.now/CVE-2024-4313.md): Table Addons for Elementor \<= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via \_id Parameter (CVSS 6.4, fusionplugin Table Addons for Elementor)
- [CVE-2024-5791](https://cve.now/CVE-2024-5791.md): Appointment Booking and Online Scheduling \<= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2024-2484](https://cve.now/CVE-2024-2484.md): Orbit Fox by ThemeIsle \<= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2024-5346](https://cve.now/CVE-2024-5346.md): Flatsome | Multi-Purpose Responsive WooCommerce Theme \<= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, UX-themes Flatsome)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.