# CVEs published 2024-08-12

119 CVEs were published on August 12, 2024: 16 critical, 45 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-37930](https://cve.now/CVE-2024-37930.md): WordPress SmartMag theme \< 10.1.0 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, ThemeSphere SmartMag)
- [CVE-2024-37924](https://cve.now/CVE-2024-37924.md): WordPress WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin \<= 1.0.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, WP2Speed Faster)
- [CVE-2024-35775](https://cve.now/CVE-2024-35775.md): WordPress Slider by Soliloquy plugin \<= 2.7.6 - Broken Access Control to XSS vulnerability (CVSS 5.9, Soliloquy Team Slider by Soliloquy)
- [CVE-2024-43123](https://cve.now/CVE-2024-43123.md): WordPress Card Elements for Elementor plugin \<= 1.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Techeshta Card Elements for Elementor)
- [CVE-2024-43124](https://cve.now/CVE-2024-43124.md): WordPress Graphina plugin \<= 1.8.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Iqonic Design Graphina)
- [CVE-2024-43125](https://cve.now/CVE-2024-43125.md): WordPress WP Table Builder plugin \<= 1.4.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Table Builder – WordPress Table Plugin)
- [CVE-2024-43126](https://cve.now/CVE-2024-43126.md): WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin \<= 2.6.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sender – Newsletter, SMS and Email Marketing Automation for…)
- [CVE-2024-43127](https://cve.now/CVE-2024-43127.md): WordPress Products, Order & Customers Export for WooCommerce plugin \<= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPFactory Products, Order & Customers Export for WooCommerce)
- [CVE-2024-7706](https://cve.now/CVE-2024-7706.md): Fujian mwcms uploadfile.html uploadimage unrestricted upload (CVSS 5.1, Fujian mwcms)
- [CVE-2024-7705](https://cve.now/CVE-2024-7705.md): Fujian mwcms Image Upload uploadeditor.html uploadeditor unrestricted upload (CVSS 5.1, Fujian mwcms)
- [CVE-2024-43130](https://cve.now/CVE-2024-43130.md): WordPress Football Pool plugin \<= 2.11.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Antoine Hurkmans Football Pool)
- [CVE-2024-43133](https://cve.now/CVE-2024-43133.md): WordPress Themify Shortcodes plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themify Shortcodes)
- [CVE-2024-43137](https://cve.now/CVE-2024-43137.md): WordPress WappPress Basic plugin \<= 6.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WappPress Team WappPress)
- [CVE-2024-43139](https://cve.now/CVE-2024-43139.md): WordPress Football Pool plugin \<= 2.11.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Antoine Hurkmans Football Pool)
- [CVE-2024-43147](https://cve.now/CVE-2024-43147.md): WordPress Selection Lite plugin \<= 1.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Merkulove Selection Lite)
- [CVE-2024-43148](https://cve.now/CVE-2024-43148.md): WordPress StreamCast \<= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, bPlugins StreamCast)
- [CVE-2024-43149](https://cve.now/CVE-2024-43149.md): WordPress CM Tooltip Glossary Plugin \<= 4.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CreativeMindsSolutions CM Tooltip Glossary)
- [CVE-2024-43150](https://cve.now/CVE-2024-43150.md): WordPress Xpro Elementor Addons plugin \<= 1.4.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Xpro Elementor Addons)
- [CVE-2024-43151](https://cve.now/CVE-2024-43151.md): WordPress Ultimate Addons for Beaver Builder – Lite plugin \<= 1.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Ultimate Addons for Beaver Builder – Lite)
- [CVE-2024-43152](https://cve.now/CVE-2024-43152.md): WordPress 3D FlipBook plugin \<= 1.15.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Ima…)
- [CVE-2024-43155](https://cve.now/CVE-2024-43155.md): WordPress ComboBlocks plugin \<= 2.2.86 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins ComboBlocks)
- [CVE-2024-43156](https://cve.now/CVE-2024-43156.md): WordPress Post Grid Master plugin \<= 3.4.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AddonMaster Post Grid Master)
- [CVE-2024-43161](https://cve.now/CVE-2024-43161.md): WordPress Slider & Popup Builder by Depicter plugin \<= 3.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Averta Depicter Slider)
- [CVE-2024-43163](https://cve.now/CVE-2024-43163.md): WordPress ParcelPanel plugin \<= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Parcel Panel ParcelPanel)
- [CVE-2024-43164](https://cve.now/CVE-2024-43164.md): WordPress Blockspare plugin \<= 3.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Blockspare)
- [CVE-2024-7590](https://cve.now/CVE-2024-7590.md): WordPress Spectra plugin\<= 2.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Spectra)
- [CVE-2023-7066](https://cve.now/CVE-2023-7066.md): Siemens Teamcenter Visualization and JT2Go Out-of-bounds Read (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2024-43210](https://cve.now/CVE-2024-43210.md): WordPress LA-Studio Element Kit for Elementor plugin \<= 1.3.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LA-Studio Element Kit for Elementor)
- [CVE-2024-43213](https://cve.now/CVE-2024-43213.md): WordPress MultiVendorX Marketplace plugin \<= 4.1.17 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MultiVendorX WC Marketplace)
- [CVE-2024-43216](https://cve.now/CVE-2024-43216.md): WordPress Filr plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Chill Filr)
- [CVE-2024-43217](https://cve.now/CVE-2024-43217.md): WordPress Kodex Posts likes plugin \<= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pierre Lebedel Kodex Posts likes)
- [CVE-2024-43218](https://cve.now/CVE-2024-43218.md): WordPress Mediavine Control Panel plugin \<= 2.10.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mediavine Control Panel)
- [CVE-2024-43220](https://cve.now/CVE-2024-43220.md): WordPress Form Maker by 10Web plugin \<= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, 10Web Form Builder Team Form Maker by 10Web)
- [CVE-2024-43224](https://cve.now/CVE-2024-43224.md): WordPress YaMaps for WordPress Plugin plugin \<= 0.6.27 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Yuri Baranov YaMaps for WordPress)
- [CVE-2024-43225](https://cve.now/CVE-2024-43225.md): WordPress Enter Addons plugin \<= 2.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeLooks Enter Addons)
- [CVE-2024-43226](https://cve.now/CVE-2024-43226.md): WordPress WP Dashboard Notes plugin \<= 1.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jeroen Sormani WP Dashboard Notes)
- [CVE-2024-43227](https://cve.now/CVE-2024-43227.md): WordPress BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin \<= 3.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper BetterDocs)
- [CVE-2024-43231](https://cve.now/CVE-2024-43231.md): WordPress Tutor LMS plugin \<= 2.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeum Tutor LMS)
- [CVE-2024-43233](https://cve.now/CVE-2024-43233.md): WordPress BSK Forms Blacklist plugin \<= 3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BannerSky BSK Forms Blacklist)
- [CVE-2024-43360](https://cve.now/CVE-2024-43360.md): ZoneMinder Time-based SQL Injection (CVSS 9.8, zoneminder)
- [CVE-2024-43359](https://cve.now/CVE-2024-43359.md): XSS vulnerabilities in montagereview (CVSS 0.0, zoneminder)
- [CVE-2024-43358](https://cve.now/CVE-2024-43358.md): XSS vulnerability in filter view (CVSS 6.1, zoneminder)
- [CVE-2024-7704](https://cve.now/CVE-2024-7704.md): Weaver e-cology Source Code ecology\_dev.zip information disclosure (CVSS 6.9, Weaver e-cology)
- [CVE-2023-41884](https://cve.now/CVE-2023-41884.md): ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php (CVSS 7.1, zoneminder)
- [CVE-2024-40893](https://cve.now/CVE-2024-40893.md): Firewalla BTLE Authenticated Command Injection (CVSS 6.8, Firewalla Box Software)
- [CVE-2024-40892](https://cve.now/CVE-2024-40892.md): Firewalla BTLE Weak Credentials (CVSS 7.1, Firewalla Box Software)
- [CVE-2024-6768](https://cve.now/CVE-2024-6768.md): Denial of Service in CLFS.sys (CVSS 6.8, Microsoft Windows)
- [CVE-2024-42474](https://cve.now/CVE-2024-42474.md): Streamlit Path Traversal Security Vulnerability on Windows (CVSS 5.9, streamlit)
- [CVE-2024-7700](https://cve.now/CVE-2024-7700.md): Foreman: command injection in "host init config" template via "install packages" field on foreman (CVSS 6.5, foreman · Red Hat Satellite)
- [CVE-2024-41909](https://cve.now/CVE-2024-41909.md): Apache MINA SSHD: integrity check bypass (CVSS 5.9, Apache Software Foundation Apache MINA SSHD · org.apache.ss…)
- [CVE-2023-7249](https://cve.now/CVE-2023-7249.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows (CVSS 6.3, OpenText Directory Services)
- [CVE-2024-42489](https://cve.now/CVE-2024-42489.md): Pro Macros Remote Code Execution via Viewpdf and similar macros (CVSS 10.0, xwikisas xwiki-pro-macros)
- [CVE-2024-42485](https://cve.now/CVE-2024-42485.md): Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint (CVSS 7.5, pxlrbt filament-excel · pxlrbt/filament-excel)
- [CVE-2024-42482](https://cve.now/CVE-2024-42482.md): fish-shop/syntax-check Improper Neutralization of Delimiters (CVSS 4.8, fish-shop syntax-check)
- [CVE-2024-42481](https://cve.now/CVE-2024-42481.md): Complete crash of host system due to calculateDirectorySize in skyportd (CVSS 7.5, skyportlabs skyportd)
- [CVE-2024-42480](https://cve.now/CVE-2024-42480.md): Kamaji's RBAC Roles for \`etcd\` are not disjunct (CVSS 8.1, clastix kamaji · github.com/clastix/kamaji)
- [CVE-2024-42479](https://cve.now/CVE-2024-42479.md): llama.cpp allows write-what-where in rpc\_server::set\_tensor (CVSS 10.0, ggerganov llama.cpp)
- [CVE-2024-42478](https://cve.now/CVE-2024-42478.md): llama.cpp allows Arbitrary Address Read in rpc\_server::get\_tensor (CVSS 5.3, ggerganov llama.cpp)
- [CVE-2024-42477](https://cve.now/CVE-2024-42477.md): llama.cpp global-buffer-overflow in ggml\_type\_size (CVSS 5.3, ggerganov llama.cpp)
- [CVE-2024-21550](https://cve.now/CVE-2024-21550.md): SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central ser (CVSS 6.1, SteVe)
- [CVE-2024-6917](https://cve.now/CVE-2024-6917.md): RCE in Veribilim Software's Veribase Order Management (CVSS 10.0, Veribilim Software Veribase Order Management)
- [CVE-2024-38530](https://cve.now/CVE-2024-38530.md): Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php" (CVSS 9.8, gunet openeclass)
- [CVE-2024-42258](https://cve.now/CVE-2024-42258.md): mm: huge\_memory: use !CONFIG\_64BIT to relax huge page alignment on 32 bit machines (CVSS 7.1, Linux)
- [CVE-2024-6639](https://cve.now/CVE-2024-6639.md): MDx \<= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx\_list\_item Shortcode (CVSS 6.4, AxtonYao MDx)
- [CVE-2024-6684](https://cve.now/CVE-2024-6684.md): Authentication Bypass in GST Electronics' inohom Nova Panel N7 (CVSS 9.9, GST Electronics inohom Nova Panel N7)
- [CVE-2024-42167](https://cve.now/CVE-2024-42167.md): Command Injection in Organisationname (CVSS 9.1, FIWARE Keyrock)
- [CVE-2024-42166](https://cve.now/CVE-2024-42166.md): Command Injection in Applicationname (CVSS 9.1, FIWARE Keyrock)
- [CVE-2024-42165](https://cve.now/CVE-2024-42165.md): Arbitrary User Activation (CVSS 6.3, FIWARE Keyrock)
- [CVE-2024-42164](https://cve.now/CVE-2024-42164.md): Disabling MFA without Authentication (CVSS 4.3, FIWARE Keyrock)
- [CVE-2024-42163](https://cve.now/CVE-2024-42163.md): Password Manipulation (CVSS 8.3, FIWARE Keyrock)
- [CVE-2024-6758](https://cve.now/CVE-2024-6758.md): Improper Privilege Management vulnerability in Sprecher Automation SPRECON-E (CVSS 6.5, Sprecher Automation SPRECON-E)
- [CVE-2024-7697](https://cve.now/CVE-2024-7697.md): Logical vulnerability in com.transsion.carlcare (CVSS 7.5, TECNO com.transsion.carlcare)
- [CVE-2024-36034](https://cve.now/CVE-2024-36034.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-36035](https://cve.now/CVE-2024-36035.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-36518](https://cve.now/CVE-2024-36518.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-5487](https://cve.now/CVE-2024-5487.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-5651](https://cve.now/CVE-2024-5651.md): Fence-agents-remediation: fence agent command line options leads to remote code execution (CVSS 8.8, fence-agents-remediation · Red Hat Fence Agents Remediation…)
- [CVE-2024-5527](https://cve.now/CVE-2024-5527.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-7694](https://cve.now/CVE-2024-7694.md): TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload (CVSS 7.2, KEV, TeamT5 ThreatSonar Anti-Ransomware)
- [CVE-2024-7693](https://cve.now/CVE-2024-7693.md): Team Johnlong software Raiden MAILD Remote Management System - Arbitrary File Reading through Path Traversal (CVSS 7.5, Team Johnlong software Raiden MAILD Remote Management System)
- [CVE-2024-7686](https://cve.now/CVE-2024-7686.md): SourceCodester Kortex Lite Advocate Office Management System register\_case.php cross site scripting (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-7685](https://cve.now/CVE-2024-7685.md): SourceCodester Kortex Lite Advocate Office Management System adds.php cross site scripting (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-7684](https://cve.now/CVE-2024-7684.md): SourceCodester Kortex Lite Advocate Office Management System add\_act.php cross site scripting (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-7683](https://cve.now/CVE-2024-7683.md): SourceCodester Kortex Lite Advocate Office Management System addcase\_stage.php cross site scripting (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-7682](https://cve.now/CVE-2024-7682.md): code-projects Job Portal rw\_i\_nat.php sql injection (CVSS 6.9, code-projects Job Portal)
- [CVE-2023-48171](https://cve.now/CVE-2023-48171.md): An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component. (CVSS 8.8)
- [CVE-2024-27442](https://cve.now/CVE-2024-27442.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. (CVSS 7.8)
- [CVE-2024-27443](https://cve.now/CVE-2024-27443.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. (CVSS 6.1, KEV)
- [CVE-2024-33533](https://cve.now/CVE-2024-33533.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. (CVSS 5.4)
- [CVE-2024-33535](https://cve.now/CVE-2024-33535.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. (CVSS 7.5)
- [CVE-2024-33536](https://cve.now/CVE-2024-33536.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. (CVSS 5.4)
- [CVE-2024-36877](https://cve.now/CVE-2024-36877.md): Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7 (CVSS 8.2)
- [CVE-2024-39091](https://cve.now/CVE-2024-39091.md): An OS command injection vulnerability in the ccm\_debug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers withi (CVSS 8.8)
- [CVE-2024-40500](https://cve.now/CVE-2024-40500.md): Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the (CVSS 8.8)
- [CVE-2024-41475](https://cve.now/CVE-2024-41475.md): Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration. (CVSS 9.8)
- [CVE-2024-41651](https://cve.now/CVE-2024-41651.md): An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. (CVSS 9.8)
- [CVE-2024-41710](https://cve.now/CVE-2024-41710.md): A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 ( (CVSS 6.8, KEV)
- [CVE-2024-42520](https://cve.now/CVE-2024-42520.md): TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl. (CVSS 9.8)
- [CVE-2024-42543](https://cve.now/CVE-2024-42543.md): TOTOLINK A3700R v9.1.2u.5822\_B20200513 has a buffer overflow vulnerability in the http\_host parameter in the loginauth function. (CVSS 8.8)
- [CVE-2024-42545](https://cve.now/CVE-2024-42545.md): TOTOLINK A3700R v9.1.2u.5822\_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function. (CVSS 9.8)
- [CVE-2024-42546](https://cve.now/CVE-2024-42546.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function. (CVSS 9.8)
- [CVE-2024-42547](https://cve.now/CVE-2024-42547.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 has a buffer overflow vulnerability in the http\_host parameter in the loginauth function. (CVSS 9.8)
- [CVE-2024-42623](https://cve.now/CVE-2024-42623.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1 (CVSS 8.8)
- [CVE-2024-42624](https://cve.now/CVE-2024-42624.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10. (CVSS 8.8)
- [CVE-2024-42625](https://cve.now/CVE-2024-42625.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add (CVSS 5.4)
- [CVE-2024-42626](https://cve.now/CVE-2024-42626.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add. (CVSS 8.8)
- [CVE-2024-42627](https://cve.now/CVE-2024-42627.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3. (CVSS 8.8)
- [CVE-2024-42628](https://cve.now/CVE-2024-42628.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3. (CVSS 8.8)
- [CVE-2024-42629](https://cve.now/CVE-2024-42629.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10. (CVSS 5.4)
- [CVE-2024-42630](https://cve.now/CVE-2024-42630.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file\_manager/create\_file. (CVSS 8.8)
- [CVE-2024-42631](https://cve.now/CVE-2024-42631.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1. (CVSS 8.8)
- [CVE-2024-42632](https://cve.now/CVE-2024-42632.md): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add. (CVSS 8.8)
- [CVE-2024-42741](https://cve.now/CVE-2024-42741.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg (CVSS 7.8)
- [CVE-2024-42742](https://cve.now/CVE-2024-42742.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRule (CVSS 8.8)
- [CVE-2024-42743](https://cve.now/CVE-2024-42743.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . (CVSS 8.8)
- [CVE-2024-42744](https://cve.now/CVE-2024-42744.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser (CVSS 8.8)
- [CVE-2024-42745](https://cve.now/CVE-2024-42745.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. (CVSS 9.8)
- [CVE-2024-42747](https://cve.now/CVE-2024-42747.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. (CVSS 7.3)
- [CVE-2024-42748](https://cve.now/CVE-2024-42748.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.