# CVEs published 2024-08-20

147 CVEs were published on August 20, 2024: 28 critical, 60 high. Days are UTC.

- [CVE-2024-43868](https://cve.now/CVE-2024-43868.md): riscv/purgatory: align riscv\_kernel\_entry (no CVSS, Linux)
- [CVE-2024-43867](https://cve.now/CVE-2024-43867.md): drm/nouveau: prime: fix refcount underflow (no CVSS, Linux)
- [CVE-2024-43866](https://cve.now/CVE-2024-43866.md): net/mlx5: Always drain health in shutdown callback (no CVSS, Linux)
- [CVE-2024-43865](https://cve.now/CVE-2024-43865.md): s390/fpu: Re-add exception handling in load\_fpu\_state() (no CVSS, Linux)
- [CVE-2024-43864](https://cve.now/CVE-2024-43864.md): net/mlx5e: Fix CT entry update leaks of modify header context (CVSS 9.8, Linux)
- [CVE-2024-43863](https://cve.now/CVE-2024-43863.md): drm/vmwgfx: Fix a deadlock in dma buf fence polling (no CVSS, Linux)
- [CVE-2024-43862](https://cve.now/CVE-2024-43862.md): net: wan: fsl\_qmc\_hdlc: Convert carrier\_lock spinlock to a mutex (no CVSS, Linux)
- [CVE-2024-8023](https://cve.now/CVE-2024-8023.md): chillzhuang SpringBlade list sql injection (CVSS 5.3, chillzhuang SpringBlade)
- [CVE-2024-8022](https://cve.now/CVE-2024-8022.md): Genexis Tilgin Home Gateway cross site scripting (CVSS 5.3, Genexis Tilgin Home Gateway)
- [CVE-2024-22281](https://cve.now/CVE-2024-22281.md): Apache Helix Front (UI): Helix front hard-coded secret in the express-session (CVSS 7.5, Apache Software Foundation Apache Helix Front · org.apache.…)
- [CVE-2024-43861](https://cve.now/CVE-2024-43861.md): net: usb: qmi\_wwan: fix memory leak for not ip packets (no CVSS, Linux)
- [CVE-2024-43403](https://cve.now/CVE-2024-43403.md): Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalation (CVSS 8.8, kanisterio kanister · github.com/kanisterio/kanister)
- [CVE-2024-42362](https://cve.now/CVE-2024-42362.md): GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import (CVSS 8.8, Apache HertzBeat)
- [CVE-2024-42361](https://cve.now/CVE-2024-42361.md): GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull} (CVSS 7.5, Apache HertzBeat)
- [CVE-2024-43396](https://cve.now/CVE-2024-43396.md): Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature) (CVSS 5.4, khoj-ai khoj · khoj)
- [CVE-2024-42363](https://cve.now/CVE-2024-42363.md): GHSL-2023-136\_Samson (CVSS 8.8, Zendesk Samson)
- [CVE-2024-41658](https://cve.now/CVE-2024-41658.md): GHSL-2024-036: Reflected XSS in QrCodePage.js (CVSS 6.1, casdoor · github.com/casdoor/casdoor)
- [CVE-2024-41657](https://cve.now/CVE-2024-41657.md): GHSL-2024-035: Casdoor CORS misconfiguration (CVSS 8.1, casdoor · github.com/casdoor/casdoor)
- [CVE-2024-41659](https://cve.now/CVE-2024-41659.md): GHSL-2024-034: memos CORS Misconfiguration in server.go (CVSS 8.1, usememos memos · github.com/usememos/memos)
- [CVE-2024-41773](https://cve.now/CVE-2024-41773.md): IBM Global Configuration Management incorrect ownership assignment (CVSS 6.5, IBM Global Configuration Management)
- [CVE-2024-6800](https://cve.now/CVE-2024-6800.md): An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity (CVSS 9.5, GitHub Enterprise Server)
- [CVE-2024-6337](https://cve.now/CVE-2024-6337.md): Incorrect Authorization allows read access to issues in GitHub Enterprise Server (CVSS 5.9, GitHub Enterprise Server)
- [CVE-2024-7711](https://cve.now/CVE-2024-7711.md): An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, an (CVSS 5.3, GitHub Enterprise Server)
- [CVE-2024-38175](https://cve.now/CVE-2024-38175.md): Azure Managed Instance for Apache Cassandra Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Azure Managed Instance for Apache Cassandra)
- [CVE-2024-6322](https://cve.now/CVE-2024-6322.md): Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account (CVSS 4.4, Grafana · github.com/grafana/grafana)
- [CVE-2024-35214](https://cve.now/CVE-2024-35214.md): Vulnerability in CylanceOPTICS Windows Installer Package Impacts CylanceOPTICS for Windows (CVSS 7.1, BlackBerry CylanceOPTICS for Windows)
- [CVE-2024-43408](https://cve.now/CVE-2024-43408.md): Discourse Placeholder Forms has a XSS stopped by CSP (CVSS 6.3, discourse-placeholder-theme-component)
- [CVE-2024-27185](https://cve.now/CVE-2024-27185.md): \[20240802\] - Core - Cache Poisoning in Pagination (CVSS 9.1, Joomla! Project Joomla! CMS)
- [CVE-2024-27186](https://cve.now/CVE-2024-27186.md): \[20240803\] - Core - XSS in HTML Mail Templates (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2024-27184](https://cve.now/CVE-2024-27184.md): \[20240801\] - Core - Inadequate validation of internal URLs (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2024-40743](https://cve.now/CVE-2024-40743.md): \[20240805\] - Core - XSS vectors in Outputfilter::strip\* methods (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2024-27187](https://cve.now/CVE-2024-27187.md): \[20240804\] - Core - Improper ACL for backend profile view (CVSS 7.5, Joomla! Project Joomla! CMS)
- [CVE-2024-43409](https://cve.now/CVE-2024-43409.md): Ghost's improper authentication allows access to member information and actions (CVSS 6.5, TryGhost Ghost · ghost +1)
- [CVE-2024-43406](https://cve.now/CVE-2024-43406.md): LF Edge eKuiper has a SQL Injection in sqlKvStore (CVSS 8.8, lf-edge ekuiper · ekuiper +1)
- [CVE-2024-43404](https://cve.now/CVE-2024-43404.md): Remote Code Execution Vulnerability in MEGABOT (CVSS 9.8, NicPWNs MEGABOT)
- [CVE-2024-43397](https://cve.now/CVE-2024-43397.md): Potential unauthorized access issue in apollo-portal (CVSS 4.3, apolloconfig apollo · com.ctrip.framework.apollo:apollo)
- [CVE-2024-43377](https://cve.now/CVE-2024-43377.md): Umbraco CMS Improper Access Control vulnerability (CVSS 5.4, Umbraco-CMS · Umbraco.Cms)
- [CVE-2024-43376](https://cve.now/CVE-2024-43376.md): Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information (CVSS 4.3, Umbraco-CMS · Umbraco.Cms.Api.Management)
- [CVE-2024-42369](https://cve.now/CVE-2024-42369.md): A room with itself as a its predecessor will freeze matrix-js-sdk (CVSS 4.1, matrix-org matrix-js-sdk · matrix-js-sdk)
- [CVE-2024-39690](https://cve.now/CVE-2024-39690.md): Capsule tenant owner with "patch namespace" permission can hijack system namespaces (CVSS 8.5, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2024-8005](https://cve.now/CVE-2024-8005.md): demozx gf\_cms JWT Authentication auth.go init hard-coded credentials (CVSS 6.9, demozx gf\_cms)
- [CVE-2024-6377](https://cve.now/CVE-2024-6377.md): URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.1, Dassault Systèmes 3DSwymer)
- [CVE-2024-6378](https://cve.now/CVE-2024-6378.md): Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2024-6379](https://cve.now/CVE-2024-6379.md): Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 7.7, Dassault Systèmes 3DSwymer)
- [CVE-2024-8003](https://cve.now/CVE-2024-8003.md): Go-Tribe gotribe-admin Log routes.go InitRoutes deserialization (CVSS 5.1, Go-Tribe gotribe-admin)
- [CVE-2024-42336](https://cve.now/CVE-2024-42336.md): Servision - CWE-287: Improper Authentication (CVSS 8.2, Servision IVG Webmax)
- [CVE-2024-42335](https://cve.now/CVE-2024-42335.md): 7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 5.4, 7Twenty Bot)
- [CVE-2024-6918](https://cve.now/CVE-2024-6918.md): CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutec (CVSS 7.5, Schneider Electric Accutech Manager)
- [CVE-2024-41700](https://cve.now/CVE-2024-41700.md): Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, Barix SIP Client Web Management Interface UI)
- [CVE-2024-25009](https://cve.now/CVE-2024-25009.md): Ericsson Packet Core Controller (PCC) - Improper Input Validation Vulnerability (CVSS 6.5, Ericsson Packet Core Controller)
- [CVE-2024-41699](https://cve.now/CVE-2024-41699.md): Priority – CWE-552: Files or Directories Accessible to External Parties (CVSS 4.4, Priority)
- [CVE-2024-41698](https://cve.now/CVE-2024-41698.md): Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, Priority)
- [CVE-2024-41697](https://cve.now/CVE-2024-41697.md): Priority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVSS 6.1, Priority)
- [CVE-2024-7054](https://cve.now/CVE-2024-7054.md): Popup Maker \<= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, danieliser Popup Maker – Boost Sales, Conversions, Optins,…)
- [CVE-2024-21689](https://cve.now/CVE-2024-21689.md): This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, a (CVSS 7.6, Atlassian Bamboo Data Center · Atlassian Bamboo Server)
- [CVE-2024-28829](https://cve.now/CVE-2024-28829.md): Privilege escalation in mk\_informix plugin (CVSS 5.2, Checkmk)
- [CVE-2024-43202](https://cve.now/CVE-2024-43202.md): Apache DolphinScheduler: Remote Code Execution Vulnerability (CVSS 9.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2024-38808](https://cve.now/CVE-2024-38808.md): CVE-2024-38808: Spring Expression DoS Vulnerability (CVSS 4.3, Spring Framework · org.springframework:spring-expression)
- [CVE-2024-6847](https://cve.now/CVE-2024-6847.md): SmartSearch WP \<= 2.4.4 - Unauthenticated SQLi (CVSS 9.8, Chatbot with ChatGPT WordPress)
- [CVE-2024-5576](https://cve.now/CVE-2024-5576.md): Tutor LMS Elementor Addons \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget (CVSS 6.4, themeum Tutor LMS Elementor Addons)
- [CVE-2024-6864](https://cve.now/CVE-2024-6864.md): WP Last Modified Info \<= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode (CVSS 6.4, infosatech WP Last Modified Info)
- [CVE-2024-38810](https://cve.now/CVE-2024-38810.md): Missing Authorization When Using @AuthorizeReturnObject (CVSS 6.5, spring security · org.springframework.security:spring-secur…)
- [CVE-2024-7782](https://cve.now/CVE-2024-7782.md): Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion (CVSS 8.7, bitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…)
- [CVE-2022-1206](https://cve.now/CVE-2022-1206.md): AdRotate – Ad manager & AdSense Ads \<= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload (CVSS 7.2, adegans AdRotate Banner Manager)
- [CVE-2024-7780](https://cve.now/CVE-2024-7780.md): Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, bitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…)
- [CVE-2024-6575](https://cve.now/CVE-2024-6575.md): The Plus Addons for Elementor \<= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-5763](https://cve.now/CVE-2024-5763.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-7777](https://cve.now/CVE-2024-7777.md): Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion (CVSS 9.0, bitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…)
- [CVE-2024-7775](https://cve.now/CVE-2024-7775.md): Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads (CVSS 5.5, bitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…)
- [CVE-2024-7702](https://cve.now/CVE-2024-7702.md): Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function (CVSS 7.2, bitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…)
- [CVE-2024-5940](https://cve.now/CVE-2024-5940.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update (CVSS 6.5, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-7827](https://cve.now/CVE-2024-7827.md): Shopping Cart & eCommerce Store \<= 5.7.2 - Authenticated (Contributor+) SQL Injection via model\_number Parameter (CVSS 8.8, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2024-5939](https://cve.now/CVE-2024-5939.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.13.0 - Missing Authorization to Limited Information Exposure (CVSS 5.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-5932](https://cve.now/CVE-2024-5932.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution (CVSS 10.0, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-5941](https://cve.now/CVE-2024-5941.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion (CVSS 5.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-7850](https://cve.now/CVE-2024-7850.md): BP Profile Search \<= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, dontdream BP Profile Search)
- [CVE-2024-7949](https://cve.now/CVE-2024-7949.md): SourceCodester Online Graduate Tracer System fetch\_genderit.php sql injection (CVSS 5.3, SourceCodester Online Graduate Tracer System)
- [CVE-2024-7948](https://cve.now/CVE-2024-7948.md): SourceCodester Accounts Manager App Update Account Page update-account.php cross site scripting (CVSS 5.3, SourceCodester Accounts Manager App)
- [CVE-2024-7947](https://cve.now/CVE-2024-7947.md): SourceCodester Point of Sales and Inventory Management System login.php sql injection (CVSS 6.9, SourceCodester Point of Sales and Inventory Management Syst…)
- [CVE-2024-7946](https://cve.now/CVE-2024-7946.md): itsourcecode Online Blood Bank Management System User Signup register.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2024-7945](https://cve.now/CVE-2024-7945.md): itsourcecode Laravel Property Management System Notes Page create cross site scripting (CVSS 5.3, itsourcecode Laravel Property Management System)
- [CVE-2024-7944](https://cve.now/CVE-2024-7944.md): itsourcecode Laravel Property Management System DocumentsController.php UpdateDocumentsRequest unrestricted upload (CVSS 5.3, itsourcecode Laravel Property Management System)
- [CVE-2024-7943](https://cve.now/CVE-2024-7943.md): itsourcecode Laravel Property Management System PropertiesController.php upload unrestricted upload (CVSS 5.3, itsourcecode Laravel Property Management System)
- [CVE-2024-7942](https://cve.now/CVE-2024-7942.md): SourceCodester Leads Manager Tool update-leads.php cross site scripting (CVSS 5.3, SourceCodester Leads Manager Tool)
- [CVE-2024-7937](https://cve.now/CVE-2024-7937.md): itsourcecode Project Expense Monitoring System printtransfer.php sql injection (CVSS 5.3, itsourcecode Project Expense Monitoring System)
- [CVE-2024-30949](https://cve.now/CVE-2024-30949.md): An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the \_gettimeofday function. (CVSS 9.8)
- [CVE-2024-31842](https://cve.now/CVE-2024-31842.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 8.8)
- [CVE-2024-33872](https://cve.now/CVE-2024-33872.md): Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of (CVSS 9.8)
- [CVE-2024-34458](https://cve.now/CVE-2024-34458.md): Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure. (CVSS 7.5)
- [CVE-2024-35540](https://cve.now/CVE-2024-35540.md): A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 7.6)
- [CVE-2024-39094](https://cve.now/CVE-2024-39094.md): Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. (CVSS 5.4)
- [CVE-2024-42006](https://cve.now/CVE-2024-42006.md): Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. (CVSS 7.5)
- [CVE-2024-42552](https://cve.now/CVE-2024-42552.md): Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book\_id parameter at admin\_room\_histo (CVSS 8.6)
- [CVE-2024-42553](https://cve.now/CVE-2024-42553.md): A Cross-Site Request Forgery (CSRF) in the component admin\_room\_added.php of Hotel Management System commit 91caab8 allows attackers to esca (CVSS 8.8)
- [CVE-2024-42554](https://cve.now/CVE-2024-42554.md): Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room\_type parameter at admin\_room\_add (CVSS 8.8)
- [CVE-2024-42555](https://cve.now/CVE-2024-42555.md): A Cross-Site Request Forgery (CSRF) in the component admin\_room\_removed.php of Hotel Management System commit 91caab8 allows attackers to es (CVSS 8.8)
- [CVE-2024-42556](https://cve.now/CVE-2024-42556.md): Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room\_type parameter at admin\_room\_rem (CVSS 9.8)
- [CVE-2024-42557](https://cve.now/CVE-2024-42557.md): A Cross-Site Request Forgery (CSRF) in the component admin\_modify\_room.php of Hotel Management System commit 91caab8 allows attackers to esc (CVSS 8.8)
- [CVE-2024-42558](https://cve.now/CVE-2024-42558.md): Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book\_id parameter at admin\_modify\_roo (CVSS 9.8)
- [CVE-2024-42559](https://cve.now/CVE-2024-42559.md): An issue in the login component (process\_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without provid (CVSS 9.8)
- [CVE-2024-42560](https://cve.now/CVE-2024-42560.md): A cross-site scripting (XSS) vulnerability in the component update\_page\_details.php of Blood Bank And Donation Management System commit dc9e (CVSS 6.1)
- [CVE-2024-42561](https://cve.now/CVE-2024-42561.md): Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice\_number parameter at sales\_r (CVSS 8.8)
- [CVE-2024-42562](https://cve.now/CVE-2024-42562.md): Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice\_number parameter at preview (CVSS 9.8)
- [CVE-2024-42563](https://cve.now/CVE-2024-42563.md): An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file. (CVSS 9.8)
- [CVE-2024-42564](https://cve.now/CVE-2024-42564.md): ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?actio (CVSS 7.6)
- [CVE-2024-42565](https://cve.now/CVE-2024-42565.md): ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action= (CVSS 9.8)
- [CVE-2024-42566](https://cve.now/CVE-2024-42566.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php (CVSS 8.8)
- [CVE-2024-42567](https://cve.now/CVE-2024-42567.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2 (CVSS 9.8)
- [CVE-2024-42568](https://cve.now/CVE-2024-42568.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php. (CVSS 9.8)
- [CVE-2024-42569](https://cve.now/CVE-2024-42569.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php. (CVSS 9.8)
- [CVE-2024-42570](https://cve.now/CVE-2024-42570.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php. (CVSS 9.8)
- [CVE-2024-42571](https://cve.now/CVE-2024-42571.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance. (CVSS 9.8)
- [CVE-2024-42572](https://cve.now/CVE-2024-42572.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php. (CVSS 9.8)
- [CVE-2024-42573](https://cve.now/CVE-2024-42573.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php. (CVSS 9.8)
- [CVE-2024-42574](https://cve.now/CVE-2024-42574.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php. (CVSS 9.8)
- [CVE-2024-42575](https://cve.now/CVE-2024-42575.md): School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php. (CVSS 9.8)
- [CVE-2024-42576](https://cve.now/CVE-2024-42576.md): A Cross-Site Request Forgery (CSRF) in the component edit\_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate priv (CVSS 8.8)
- [CVE-2024-42577](https://cve.now/CVE-2024-42577.md): A Cross-Site Request Forgery (CSRF) in the component add\_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privile (CVSS 8.8)
- [CVE-2024-42578](https://cve.now/CVE-2024-42578.md): A Cross-Site Request Forgery (CSRF) in the component edit\_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privil (CVSS 8.0)
- [CVE-2024-42579](https://cve.now/CVE-2024-42579.md): A Cross-Site Request Forgery (CSRF) in the component add\_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privilege (CVSS 8.8)
- [CVE-2024-42580](https://cve.now/CVE-2024-42580.md): A Cross-Site Request Forgery (CSRF) in the component edit\_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileg (CVSS 5.7)
- [CVE-2024-42581](https://cve.now/CVE-2024-42581.md): A Cross-Site Request Forgery (CSRF) in the component delete\_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privil (CVSS 9.6)
- [CVE-2024-42582](https://cve.now/CVE-2024-42582.md): A Cross-Site Request Forgery (CSRF) in the component delete\_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate pr (CVSS 8.8)
- [CVE-2024-42583](https://cve.now/CVE-2024-42583.md): A Cross-Site Request Forgery (CSRF) in the component delete\_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privile (CVSS 8.8)
- [CVE-2024-42584](https://cve.now/CVE-2024-42584.md): A Cross-Site Request Forgery (CSRF) in the component delete\_product.php of Warehouse Inventory System v2.0 allows attackers to escalate priv (CVSS 8.8)
- [CVE-2024-42585](https://cve.now/CVE-2024-42585.md): A Cross-Site Request Forgery (CSRF) in the component delete\_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privil (CVSS 8.8)
- [CVE-2024-42586](https://cve.now/CVE-2024-42586.md): A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privilege (CVSS 8.8)
- [CVE-2024-42598](https://cve.now/CVE-2024-42598.md): SeaCMS 13.0 has a remote code execution vulnerability. (CVSS 6.7)
- [CVE-2024-42603](https://cve.now/CVE-2024-42603.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_backup.php?dobackup=clearall (CVSS 5.7)
- [CVE-2024-42604](https://cve.now/CVE-2024-42604.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_group.php?mode=delete&group\_id (CVSS 8.8)
- [CVE-2024-42605](https://cve.now/CVE-2024-42605.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit\_page.php?link\_id=1 (CVSS 7.1)
- [CVE-2024-42606](https://cve.now/CVE-2024-42606.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_log.php?clear=1 (CVSS 5.7)
- [CVE-2024-42607](https://cve.now/CVE-2024-42607.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_backup.php?dobackup=database (CVSS 8.8)
- [CVE-2024-42608](https://cve.now/CVE-2024-42608.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit\_page.php. (CVSS 8.8)
- [CVE-2024-42609](https://cve.now/CVE-2024-42609.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_backup.php?dobackup=avatars (CVSS 7.1)
- [CVE-2024-42610](https://cve.now/CVE-2024-42610.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_backup.php?dobackup=files (CVSS 8.8)
- [CVE-2024-42611](https://cve.now/CVE-2024-42611.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin\_page.php?link\_id=1&mode=delete (CVSS 8.8)
- [CVE-2024-42612](https://cve.now/CVE-2024-42612.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain\_management.php?whitelist\_add (CVSS 8.8)
- [CVE-2024-42613](https://cve.now/CVE-2024-42613.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_widgets.php?action=install&wid (CVSS 8.8)
- [CVE-2024-42616](https://cve.now/CVE-2024-42616.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_widgets.php?action=remove&widg (CVSS 8.8)
- [CVE-2024-42617](https://cve.now/CVE-2024-42617.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_config.php?action=save&var\_id= (CVSS 8.8)
- [CVE-2024-42618](https://cve.now/CVE-2024-42618.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma (CVSS 8.8)
- [CVE-2024-42619](https://cve.now/CVE-2024-42619.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain\_management.php?id=0&list=whit (CVSS 8.8)
- [CVE-2024-42621](https://cve.now/CVE-2024-42621.md): Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin\_editor.php (CVSS 8.8)
- [CVE-2024-42662](https://cve.now/CVE-2024-42662.md): An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request. (CVSS 7.5)
- [CVE-2024-42919](https://cve.now/CVE-2024-42919.md): eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport. (CVSS 9.8)
- [CVE-2024-43688](https://cve.now/CVE-2024-43688.md): cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.