# CVEs published 2024-07-28

27 CVEs were published on July 28, 2024: 1 critical, 7 high. Days are UTC.

- [CVE-2024-7173](https://cve.now/CVE-2024-7173.md): TOTOLINK A3600R cstecgi.cgi loginauth buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7172](https://cve.now/CVE-2024-7172.md): TOTOLINK A3600R getSaveConfig buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7171](https://cve.now/CVE-2024-7171.md): TOTOLINK A3600R cstecgi.cgi NTPSyncWithHost os command injection (CVSS 5.3, TOTOLINK A3600R)
- [CVE-2024-7170](https://cve.now/CVE-2024-7170.md): TOTOLINK A3000RU product.ini hard-coded password (CVSS 5.1, TOTOLINK A3000RU)
- [CVE-2024-7169](https://cve.now/CVE-2024-7169.md): SourceCodester School Fees Payment System ajax.php cross-site request forgery (CVSS 6.9, SourceCodester School Fees Payment System)
- [CVE-2024-7168](https://cve.now/CVE-2024-7168.md): SourceCodester School Fees Payment System manage\_user.php sql injection (CVSS 5.3, SourceCodester School Fees Payment System)
- [CVE-2024-7167](https://cve.now/CVE-2024-7167.md): SourceCodester School Fees Payment System manage\_course.php sql injection (CVSS 5.3, SourceCodester School Fees Payment System)
- [CVE-2024-7166](https://cve.now/CVE-2024-7166.md): SourceCodester School Fees Payment System receipt.php sql injection (CVSS 5.3, SourceCodester School Fees Payment System)
- [CVE-2024-7165](https://cve.now/CVE-2024-7165.md): SourceCodester School Fees Payment System view\_payment.php sql injection (CVSS 5.3, SourceCodester School Fees Payment System)
- [CVE-2024-7164](https://cve.now/CVE-2024-7164.md): SourceCodester School Fees Payment System sql injection (CVSS 6.9, SourceCodester School Fees Payment System)
- [CVE-2024-7163](https://cve.now/CVE-2024-7163.md): SeaCMS index.php cross site scripting (CVSS 5.3, SeaCMS)
- [CVE-2024-7162](https://cve.now/CVE-2024-7162.md): SeaCMS cross site scripting (CVSS 5.3, SeaCMS)
- [CVE-2024-7161](https://cve.now/CVE-2024-7161.md): SeaCMS Password Change cross-site request forgery (CVSS 6.9, SeaCMS)
- [CVE-2024-7160](https://cve.now/CVE-2024-7160.md): TOTOLINK A3700R cstecgi.cgi setWanCfg command injection (CVSS 5.3, TOTOLINK A3700R)
- [CVE-2024-7159](https://cve.now/CVE-2024-7159.md): TOTOLINK A3600R Telnet Service product.ini hard-coded password (CVSS 5.1, TOTOLINK A3600R)
- [CVE-2024-7158](https://cve.now/CVE-2024-7158.md): TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injection (CVSS 5.3, TOTOLINK A3100R)
- [CVE-2024-7157](https://cve.now/CVE-2024-7157.md): TOTOLINK A3100R getSaveConfig buffer overflow (CVSS 8.7, TOTOLINK A3100R)
- [CVE-2024-7156](https://cve.now/CVE-2024-7156.md): TOTOLINK A3700R apmib Configuration ExportSettings.sh information disclosure (CVSS 6.9, TOTOLINK A3700R)
- [CVE-2024-7155](https://cve.now/CVE-2024-7155.md): TOTOLINK A3300R shadow.sample hard-coded password (CVSS 2.0, TOTOLINK A3300R)
- [CVE-2024-7154](https://cve.now/CVE-2024-7154.md): TOTOLINK A3700R Password Reset wizard.html access control (CVSS 5.3, TOTOLINK A3700R)
- [CVE-2024-42049](https://cve.now/CVE-2024-42049.md): TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection. (CVSS 9.1)
- [CVE-2024-42050](https://cve.now/CVE-2024-42050.md): The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. (CVSS 7.0)
- [CVE-2024-42051](https://cve.now/CVE-2024-42051.md): The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. (CVSS 7.8)
- [CVE-2024-42052](https://cve.now/CVE-2024-42052.md): The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. (CVSS 7.8)
- [CVE-2024-42053](https://cve.now/CVE-2024-42053.md): The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. (CVSS 7.8)
- [CVE-2024-42054](https://cve.now/CVE-2024-42054.md): Cervantes through 0.5-alpha accepts insecure file uploads. (CVSS 5.4)
- [CVE-2024-42055](https://cve.now/CVE-2024-42055.md): Cervantes through 0.5-alpha allows stored XSS. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.