# CVEs published 2024-08-03

21 CVEs were published on August 3, 2024: 1 critical, 5 high. Days are UTC.

- [CVE-2024-7446](https://cve.now/CVE-2024-7446.md): itsourcecode Ticket Reservation System list\_tickets.php sql injection (CVSS 5.1, itsourcecode Ticket Reservation System)
- [CVE-2024-7445](https://cve.now/CVE-2024-7445.md): itsourcecode Ticket Reservation System checkout\_ticket\_save.php sql injection (CVSS 5.1, itsourcecode Ticket Reservation System)
- [CVE-2024-7444](https://cve.now/CVE-2024-7444.md): itsourcecode Ticket Reservation System Login Page login.php sql injection (CVSS 6.9, itsourcecode Ticket Reservation System)
- [CVE-2024-7443](https://cve.now/CVE-2024-7443.md): Vivotek IB8367A upload\_file.cgi getenv command injection (CVSS 5.3, Vivotek IB8367A)
- [CVE-2024-7442](https://cve.now/CVE-2024-7442.md): Vivotek SD9364 upload\_file.cgi getenv command injection (CVSS 5.3, Vivotek SD9364)
- [CVE-2024-7441](https://cve.now/CVE-2024-7441.md): Vivotek SD9364 httpd read stack-based overflow (CVSS 8.7, Vivotek SD9364)
- [CVE-2024-7440](https://cve.now/CVE-2024-7440.md): Vivotek CC8160 upload\_file.cgi getenv command injection (CVSS 5.3, Vivotek CC8160)
- [CVE-2024-7439](https://cve.now/CVE-2024-7439.md): Vivotek CC8160 httpd read stack-based overflow (CVSS 8.7, Vivotek CC8160)
- [CVE-2024-7438](https://cve.now/CVE-2024-7438.md): SimpleMachines SMF User Alert Read Status index.php resource injection (CVSS 5.3, SimpleMachines SMF)
- [CVE-2024-37286](https://cve.now/CVE-2024-37286.md): APM Server Insertion of Sensitive Information into Log File (CVSS 5.7, Elastic APM Server · github.com/elastic/apm-server)
- [CVE-2024-7437](https://cve.now/CVE-2024-7437.md): SimpleMachines SMF Delete User index.php resource injection (CVSS 5.3, SimpleMachines SMF)
- [CVE-2024-7436](https://cve.now/CVE-2024-7436.md): D-Link DI-8100 msp\_info.htm msp\_info\_htm command injection (CVSS 5.3, D-Link DI-8100)
- [CVE-2024-38321](https://cve.now/CVE-2024-38321.md): IBM Business Automation Workflow information disclosure (CVSS 5.3, IBM Business Automation Workflow)
- [CVE-2024-6872](https://cve.now/CVE-2024-6872.md): Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateSpare \<= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update (CVSS 4.3, TemplateSpare – 1000+ WordPress Starter Templates & Full Si…)
- [CVE-2024-6709](https://cve.now/CVE-2024-6709.md): Sync Post With Other Site \<= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update (CVSS 4.3, kp4coder Sync Post With Other Site)
- [CVE-2024-7356](https://cve.now/CVE-2024-7356.md): Zephyr Project Manager \<= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter (CVSS 6.4, dylanjkotze Zephyr Project Manager)
- [CVE-2024-7257](https://cve.now/CVE-2024-7257.md): YayExtra – WooCommerce Extra Product Options \<= 1.3.7 - Unauthenticated Arbitrary File Upload via handle\_upload\_file Function (CVSS 9.8, yaycommerce YayExtra – WooCommerce Extra Product Options)
- [CVE-2024-7031](https://cve.now/CVE-2024-7031.md): File Manager Pro – Filester \<= 1.8.2 - Authenticated Plugin Settings Update (CVSS 7.5, ninjateam File Manager Pro – Filester)
- [CVE-2024-7291](https://cve.now/CVE-2024-7291.md): JetFormBuilder \<= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation (CVSS 7.2, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2024-6477](https://cve.now/CVE-2024-6477.md): UsersWP \< 1.2.12 - Users Information Disclosure (CVSS 7.5, UsersWP)
- [CVE-2024-6390](https://cve.now/CVE-2024-6390.md): Quiz and Survey Master (QSM) \< 9.1.0 - Contributor+ Stored XSS (CVSS 5.9, Quiz and Survey Master)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.