# CVEs published 2024-06-23

9 CVEs were published on June 23, 2024: 1 critical, 0 high. Days are UTC.

- [CVE-2024-6273](https://cve.now/CVE-2024-6273.md): SourceCodester Clinic Queuing System patient\_side.php save\_patient cross site scripting (CVSS 6.9, SourceCodester Clinic Queuing System)
- [CVE-2024-4841](https://cve.now/CVE-2024-4841.md): Path Traversal in parisneo/lollms-webui (CVSS 4.0, parisneo/lollms-webui)
- [CVE-2024-6269](https://cve.now/CVE-2024-6269.md): Ruijie RG-UAC HTTP POST Request sxh\_vpnlic.php get\_ip.addr\_details command injection (CVSS 5.1, Ruijie RG-UAC)
- [CVE-2024-6268](https://cve.now/CVE-2024-6268.md): lahirudanushka School Management System Login Page login.php sql injection (CVSS 6.9, lahirudanushka School Management System)
- [CVE-2024-6267](https://cve.now/CVE-2024-6267.md): SourceCodester Service Provider Management System System Info Page index.php cross site scripting (CVSS 5.1, SourceCodester Service Provider Management System)
- [CVE-2024-6266](https://cve.now/CVE-2024-6266.md): Pear Admin Boot loadDictItem sql injection (CVSS 5.3, Pear Admin Boot)
- [CVE-2024-39331](https://cve.now/CVE-2024-39331.md): In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as s (CVSS 9.8)
- [CVE-2024-39334](https://cve.now/CVE-2024-39334.md): MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. (CVSS 6.5)
- [CVE-2024-39337](https://cve.now/CVE-2024-39337.md): Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.