# CVEs published 2024-08-24

28 CVEs were published on August 24, 2024: 2 critical, 8 high. Days are UTC.

- [CVE-2024-8137](https://cve.now/CVE-2024-8137.md): SourceCodester Record Management System search\_user.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-8136](https://cve.now/CVE-2024-8136.md): SourceCodester Record Management System sort1\_user.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-8135](https://cve.now/CVE-2024-8135.md): Go-Tribe gotribe token.go Sign hard-coded credentials (CVSS 5.3, Go-Tribe gotribe)
- [CVE-2024-8134](https://cve.now/CVE-2024-8134.md): D-Link DNS-1550-04 HTTP POST Request hd\_config.cgi cgi\_FMT\_Std2R5\_1st\_DiskMGR command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8133](https://cve.now/CVE-2024-8133.md): D-Link DNS-1550-04 HTTP POST Request hd\_config.cgi cgi\_FMT\_R5\_SpareDsk\_DiskMGR command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8132](https://cve.now/CVE-2024-8132.md): D-Link DNS-1550-04 HTTP POST Request webdav\_mgr.cgi webdav\_mgr command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8131](https://cve.now/CVE-2024-8131.md): D-Link DNS-1550-04 HTTP POST Request apkg\_mgr.cgi module\_enable\_disable command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8130](https://cve.now/CVE-2024-8130.md): D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi\_s3 command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8129](https://cve.now/CVE-2024-8129.md): D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi\_s3\_modify command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-7656](https://cve.now/CVE-2024-7656.md): Image Hotspot by DevVN \<= 1.2.5 - Authenticated (Author+) PHP Object Injection (CVSS 8.8, levantoan Image Hotspot by DevVN)
- [CVE-2024-8128](https://cve.now/CVE-2024-8128.md): D-Link DNS-1550-04 HTTP POST Request webfile\_mgr.cgi cgi\_add\_zip command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2022-43915](https://cve.now/CVE-2022-43915.md): IBM App Connect Enterprise Certified Container (CVSS 6.8, IBM App Connect Enterprise Certified Container)
- [CVE-2024-8127](https://cve.now/CVE-2024-8127.md): D-Link DNS-1550-04 HTTP POST Request webfile\_mgr.cgi cgi\_unzip command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-7351](https://cve.now/CVE-2024-7351.md): Simple Job Board \<= 2.12.3 - Authenticated (Editor+) PHP Object Injection (CVSS 7.2, presstigers Simple Job Board)
- [CVE-2024-6499](https://cve.now/CVE-2024-6499.md): WordPress Button Plugin MaxButtons \<= 9.7.8 - Full Path Disclosure (CVSS 5.3, maxfoundry MaxButtons – Create buttons)
- [CVE-2024-6631](https://cve.now/CVE-2024-6631.md): ImageRecycle pdf & image compression \<= 3.1.14 - Missing Authorization in Several AJAX Actions (CVSS 5.0, ImageRecycle pdf & image compression)
- [CVE-2024-2254](https://cve.now/CVE-2024-2254.md): RT Easy Builder – Advanced addons for Elementor \<= 2.3 - Authenticated (Contributor+) Stored Cross-site Scripting (CVSS 6.4, risetheme RT Easy Builder – Advanced addons for Elementor)
- [CVE-2024-8120](https://cve.now/CVE-2024-8120.md): ImageRecycle pdf & image compression \<= 3.1.14 - Cross-Site Request in Several AJAX Actions (CVSS 4.7, ImageRecycle pdf & image compression)
- [CVE-2023-0926](https://cve.now/CVE-2023-0926.md): Custom Permalinks \<= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting (CVSS 4.4, sasiddiqui Custom Permalinks)
- [CVE-2024-7568](https://cve.now/CVE-2024-7568.md): Favicon Generator \<= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 9.6, brandondove Favicon Generator)
- [CVE-2023-6987](https://cve.now/CVE-2023-6987.md): String Locator \<= 2.6.5 - Reflected Cross-Site Scripting (CVSS 6.1, instawp String locator)
- [CVE-2024-45234](https://cve.now/CVE-2024-45234.md): An issue was discovered in Fort before 1.6.3. (CVSS 7.5)
- [CVE-2024-45235](https://cve.now/CVE-2024-45235.md): An issue was discovered in Fort before 1.6.3. (CVSS 7.5)
- [CVE-2024-45236](https://cve.now/CVE-2024-45236.md): An issue was discovered in Fort before 1.6.3. (CVSS 7.5)
- [CVE-2024-45237](https://cve.now/CVE-2024-45237.md): An issue was discovered in Fort before 1.6.3. (CVSS 9.8)
- [CVE-2024-45238](https://cve.now/CVE-2024-45238.md): An issue was discovered in Fort before 1.6.3. (CVSS 7.5)
- [CVE-2024-45239](https://cve.now/CVE-2024-45239.md): An issue was discovered in Fort before 1.6.3. (CVSS 7.5)
- [CVE-2024-45240](https://cve.now/CVE-2024-45240.md): The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via de (CVSS 7.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.