# CVEs published 2024-08-25

24 CVEs were published on August 25, 2024: 1 critical, 2 high. Days are UTC.

- [CVE-2024-8155](https://cve.now/CVE-2024-8155.md): ContiNew Admin tree sql injection (CVSS 5.1, ContiNew Admin)
- [CVE-2024-8154](https://cve.now/CVE-2024-8154.md): SourceCodester QR Code Bookmark System Parameter update-bookmark.php cross site scripting (CVSS 5.3, SourceCodester QR Code Bookmark System)
- [CVE-2024-8153](https://cve.now/CVE-2024-8153.md): SourceCodester QR Code Bookmark System delete-bookmark.php cross site scripting (CVSS 5.3, SourceCodester QR Code Bookmark System)
- [CVE-2024-8152](https://cve.now/CVE-2024-8152.md): SourceCodester QR Code Bookmark System Parameter add-bookmark.php cross site scripting (CVSS 5.3, SourceCodester QR Code Bookmark System)
- [CVE-2024-8151](https://cve.now/CVE-2024-8151.md): SourceCodester Interactive Map with Marker delete-mark.php cross site scripting (CVSS 5.3, SourceCodester Interactive Map with Marker)
- [CVE-2024-8150](https://cve.now/CVE-2024-8150.md): ContiNew Admin user sql injection (CVSS 5.1, ContiNew Admin)
- [CVE-2024-8158](https://cve.now/CVE-2024-8158.md): User impersonation for lib9p based 9p fileservers (CVSS 8.8, 9front)
- [CVE-2024-8011](https://cve.now/CVE-2024-8011.md): Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions grante (CVSS 2.0, Logitech Options+)
- [CVE-2024-8147](https://cve.now/CVE-2024-8147.md): code-projects Pharmacy Management System index.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-8146](https://cve.now/CVE-2024-8146.md): code-projects Pharmacy Management System index.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-42340](https://cve.now/CVE-2024-42340.md): CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security (CVSS 8.3, CyberArk Identity Management)
- [CVE-2024-42339](https://cve.now/CVE-2024-42339.md): CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, CyberArk Identity Management)
- [CVE-2024-42338](https://cve.now/CVE-2024-42338.md): CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, CyberArk Identity Management)
- [CVE-2024-42337](https://cve.now/CVE-2024-42337.md): CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, CyberArk Identity Management)
- [CVE-2024-8145](https://cve.now/CVE-2024-8145.md): ClassCMS Article admin cross site scripting (CVSS 5.1, ClassCMS)
- [CVE-2024-8144](https://cve.now/CVE-2024-8144.md): ClassCMS Logo admin cross site scripting (CVSS 5.3, ClassCMS)
- [CVE-2024-8142](https://cve.now/CVE-2024-8142.md): SourceCodester Daily Calories Monitoring Tool delete-calorie.php cross site scripting (CVSS 5.3, SourceCodester Daily Calories Monitoring Tool)
- [CVE-2024-8141](https://cve.now/CVE-2024-8141.md): SourceCodester Daily Calories Monitoring Tool add-calorie.php cross site scripting (CVSS 5.3, SourceCodester Daily Calories Monitoring Tool)
- [CVE-2024-8140](https://cve.now/CVE-2024-8140.md): SourceCodester Task Progress Tracker update-task.php cross site scripting (CVSS 5.3, SourceCodester Task Progress Tracker)
- [CVE-2024-8139](https://cve.now/CVE-2024-8139.md): itsourcecode E-Commerce Website search\_list.php sql injection (CVSS 5.3, itsourcecode E-Commerce Website)
- [CVE-2024-8138](https://cve.now/CVE-2024-8138.md): code-projects Pharmacy Management System Parameter index.php editManager sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2023-48957](https://cve.now/CVE-2023-48957.md): PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to (CVSS 5.3)
- [CVE-2024-45244](https://cve.now/CVE-2024-45244.md): Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window. (CVSS 5.3, github.com/hyperledger/fabric)
- [CVE-2024-45258](https://cve.now/CVE-2024-45258.md): The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intention (CVSS 9.8, github.com/imroc/req · github.com/imroc/req/v2 +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.