# CVEs published 2024-08-26

140 CVEs were published on August 26, 2024: 11 critical, 32 high. Days are UTC.

- [CVE-2024-45036](https://cve.now/CVE-2024-45036.md): Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link (CVSS 4.3, Shopify tophat)
- [CVE-2024-43798](https://cve.now/CVE-2024-43798.md): Chisel AUTH environment variable not respected in server entrypoint (CVSS 8.6, jpillora chisel · github.com/jpillora/chisel)
- [CVE-2024-39628](https://cve.now/CVE-2024-39628.md): WordPress Ninja Forms plugin \<= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Saturday Drive Ninja Forms)
- [CVE-2024-39641](https://cve.now/CVE-2024-39641.md): WordPress LearnPress plugin \<= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThimPress LearnPress)
- [CVE-2024-39645](https://cve.now/CVE-2024-39645.md): WordPress Tutor LMS plugin \<= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Themeum Tutor LMS)
- [CVE-2024-39657](https://cve.now/CVE-2024-39657.md): WordPress Sender plugin \<= 2.6.18 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Sender – Newsletter, SMS and Email Marketing Automation for…)
- [CVE-2024-43116](https://cve.now/CVE-2024-43116.md): WordPress Simple Local Avatars plugin \<= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, 10up Simple Local Avatars)
- [CVE-2024-43117](https://cve.now/CVE-2024-43117.md): WordPress Hummingbird plugin \<= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WPMU DEV - Your All-in-One WordPress Platform Hummingbird)
- [CVE-2024-43265](https://cve.now/CVE-2024-43265.md): WordPress Analytify plugin \<= 5.3.1 - CSRF Leading to Optout Vulnerability (CVSS 4.3, Analytify)
- [CVE-2024-43269](https://cve.now/CVE-2024-43269.md): WordPress Backup and Restore WordPress plugin \<= 1.50 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WPBackItUp Backup and Restore WordPress)
- [CVE-2024-43287](https://cve.now/CVE-2024-43287.md): WordPress Brevo plugin \<= 3.1.82 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Brevo Newsletter, SMTP, Email marketing and Subscribe forms…)
- [CVE-2024-43295](https://cve.now/CVE-2024-43295.md): WordPress WP Data Access plugin \<= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Passionate Programmers B.V. WP Data Access)
- [CVE-2024-43299](https://cve.now/CVE-2024-43299.md): WordPress SpeedyCache plugin \<= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Softaculous SpeedyCache)
- [CVE-2024-43301](https://cve.now/CVE-2024-43301.md): WordPress Fonts plugin \<= 3.7.7 - Cross Site Request Forgery (CSRF) to Stored XSSvulnerability (CVSS 7.1, Fonts Plugin Fonts)
- [CVE-2024-43316](https://cve.now/CVE-2024-43316.md): WordPress Stripe Payments For WooCommerce plugin \<= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Checkout Plugins Stripe Payments For WooCommerce by Checkout)
- [CVE-2024-43325](https://cve.now/CVE-2024-43325.md): WordPress Dark Mode for WP Dashboard plugin \<= 1.2.3 - Cross Site Request Forgery vulnerability (CVSS 4.3, Naiche Dark Mode for WP Dashboard)
- [CVE-2024-43336](https://cve.now/CVE-2024-43336.md): WordPress WP User Manager – User Profile Builder & Membership plugin \<= 2.9.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WP User Manager)
- [CVE-2024-43337](https://cve.now/CVE-2024-43337.md): WordPress Brave plugin \<= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Brave Popup Builder)
- [CVE-2024-43340](https://cve.now/CVE-2024-43340.md): WordPress AFI – The Easiest Integration Plugin plugin \<= 1.89.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Nasirahmed Advanced Form Integration)
- [CVE-2024-43915](https://cve.now/CVE-2024-43915.md): WordPress Zephyr Project Manager plugin \<=3.3.102 - Cross Site Scripting (XSS) vulnerability (CVSS 5.5, Dylan James Zephyr Project Manager)
- [CVE-2024-43356](https://cve.now/CVE-2024-43356.md): WordPress oik plugin \<= 4.12.0 - Arbitrary File Deletion vulnerability (CVSS 4.3, bobbingwide oik)
- [CVE-2024-43255](https://cve.now/CVE-2024-43255.md): WordPress MyBookTable Bookstore by Stormhill Media plugin \<= 3.3.9 - CSRF to XSS vulnerability (CVSS 7.1, zookatron MyBookTable Bookstore)
- [CVE-2024-43339](https://cve.now/CVE-2024-43339.md): WordPress WordPress Webinar Plugin – WebinarPress plugin \<= 1.33.20 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WebinarPress)
- [CVE-2024-43916](https://cve.now/CVE-2024-43916.md): WordPress Zephyr Project Manager plugin \<= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Dylan James Zephyr Project Manager)
- [CVE-2024-43214](https://cve.now/CVE-2024-43214.md): WordPress myCred plugin \<= 2.7.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Saad Iqbal myCred)
- [CVE-2024-43230](https://cve.now/CVE-2024-43230.md): WordPress Shared Files – Premium Download Manager & Secure File Sharing with Frontend File Upload plugin \<= 1.7.28 - Sensitive Data Exposure vulnerability (CVSS 5.3, Anssi Laitila Shared Files)
- [CVE-2024-43251](https://cve.now/CVE-2024-43251.md): WordPress Bit Form Pro plugin \<= 2.6.4 - Authenticated Sensitive Data Exposure vulnerability (CVSS 6.5, Bit Apps Bit Form Pro)
- [CVE-2024-43257](https://cve.now/CVE-2024-43257.md): WordPress Leopard plugin \<= 2.0.36 - Subscriber+ Sensitive Data Exposure vulnerability (CVSS 6.5, Nouthemes Leopard - WordPress offload media)
- [CVE-2024-43258](https://cve.now/CVE-2024-43258.md): WordPress Store Locator Plus® for WordPress plugin \<= 2311.17.01 - Sensitive Data Exposure vulnerability (CVSS 5.3, Store Locator Plus)
- [CVE-2024-43259](https://cve.now/CVE-2024-43259.md): WordPress Order Export for WooCommerce plugin \<= 3.23 - Sensitive Data Exposure vulnerability (CVSS 5.3, WebFactory Order Export for WooCommerce)
- [CVE-2024-43264](https://cve.now/CVE-2024-43264.md): WordPress Create by Mediavine plugin \<= 1.9.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, mischiefmarmot Create by Mediavine)
- [CVE-2024-8105](https://cve.now/CVE-2024-8105.md): Insecure Platform Key (PK) used in UEFI system firmware signature (CVSS 6.4, Acer vz2694g · Acer aspire s +671)
- [CVE-2024-43802](https://cve.now/CVE-2024-43802.md): heap-buffer-overflow in ins\_typebuf() in Vim \< 9.1.0697 (CVSS 4.5, vim)
- [CVE-2024-43806](https://cve.now/CVE-2024-43806.md): \`rustix::fs::Dir\` iterator with the \`linux\_raw\` backend can cause memory explosion (CVSS 6.5, bytecodealliance rustix · rustix)
- [CVE-2024-7401](https://cve.now/CVE-2024-7401.md): Client Enrollment Process Bypass (CVSS 8.5, Netskope Client)
- [CVE-2024-8174](https://cve.now/CVE-2024-8174.md): code-projects Blood Bank System Login Page login.php cross site scripting (CVSS 6.9, code-projects Blood Bank System)
- [CVE-2024-43283](https://cve.now/CVE-2024-43283.md): WordPress Contest Gallery plugin \<= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability (CVSS 5.3, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2024-43289](https://cve.now/CVE-2024-43289.md): WordPress wpForo Forum plugin \<= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability (CVSS 7.5, gVectors Team wpForo Forum)
- [CVE-2024-43319](https://cve.now/CVE-2024-43319.md): WordPress HTML5 Video Player plugin \<= 2.5.31 - Sensitive Data Exposure vulnerability (CVSS 4.3, bPlugins Flash & HTML5 Video)
- [CVE-2024-8173](https://cve.now/CVE-2024-8173.md): code-projects Blood Bank System Login Page login.php sql injection (CVSS 6.9, code-projects Blood Bank System)
- [CVE-2024-8172](https://cve.now/CVE-2024-8172.md): SourceCodester QR Code Attendance System delete-student.php cross site scripting (CVSS 5.3, SourceCodester QR Code Attendance System)
- [CVE-2024-8171](https://cve.now/CVE-2024-8171.md): itsourcecode Tailoring Management System staffcatedit.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-8170](https://cve.now/CVE-2024-8170.md): SourceCodester Zipped Folder Manager App add-folder.php unrestricted upload (CVSS 5.3, SourceCodester Zipped Folder Manager App)
- [CVE-2024-43967](https://cve.now/CVE-2024-43967.md): WordPress WP Testimonial Widget plugin \<= 3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Stark Digital WP Testimonial Widget)
- [CVE-2024-43966](https://cve.now/CVE-2024-43966.md): WordPress WP Testimonial Widget plugin \<= 3.1 - SQL Injection vulnerability (CVSS 7.6, Stark Digital WP Testimonial Widget)
- [CVE-2024-8169](https://cve.now/CVE-2024-8169.md): code-projects Online Quiz Site signupuser.php sql injection (CVSS 6.9, code-projects Online Quiz Site)
- [CVE-2024-8168](https://cve.now/CVE-2024-8168.md): code-projects Online Bus Reservation Site login.php sql injection (CVSS 6.9, code-projects Online Bus Reservation Site)
- [CVE-2024-7988](https://cve.now/CVE-2024-7988.md): ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities (CVSS 9.3, Rockwell Automation ThinManager® ThinServer™)
- [CVE-2024-7987](https://cve.now/CVE-2024-7987.md): Rockwell Automation ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities (CVSS 8.5, Rockwell Automation ThinManager® ThinServer™)
- [CVE-2024-8167](https://cve.now/CVE-2024-8167.md): code-projects Job Portal forget.php sql injection (CVSS 6.9, code-projects Job Portal)
- [CVE-2024-8166](https://cve.now/CVE-2024-8166.md): Ruijie EG2000K index.php unrestricted upload (CVSS 5.1, Ruijie EG2000K)
- [CVE-2024-38859](https://cve.now/CVE-2024-38859.md): XSS in view page with SLA column (CVSS 4.8, Checkmk)
- [CVE-2023-49582](https://cve.now/CVE-2023-49582.md): Apache Portable Runtime (APR): Unexpected lax shared memory permissions (CVSS 5.5, Apache Software Foundation Apache Portable Runtime)
- [CVE-2024-8165](https://cve.now/CVE-2024-8165.md): Chengdu Everbrite Network Technology BeikeShop export exportZip path traversal (CVSS 5.3, Chengdu Everbrite Network Technology BeikeShop)
- [CVE-2024-8164](https://cve.now/CVE-2024-8164.md): Chengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted upload (CVSS 5.3, Chengdu Everbrite Network Technology BeikeShop)
- [CVE-2024-8163](https://cve.now/CVE-2024-8163.md): Chengdu Everbrite Network Technology BeikeShop files destroyFiles path traversal (CVSS 5.3, Chengdu Everbrite Network Technology BeikeShop)
- [CVE-2024-8162](https://cve.now/CVE-2024-8162.md): TOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentials (CVSS 9.3, TOTOLINK T10 AC1200)
- [CVE-2024-41879](https://cve.now/CVE-2024-41879.md): RE: New Edge T5 MSRC Case \[DCMSFT-1294\] (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26315](https://cve.now/CVE-2023-26315.md): Xiaomi router has a command injection vulnerability after authorization (CVSS 6.5, Xiaomi Router AX9000)
- [CVE-2024-44942](https://cve.now/CVE-2024-44942.md): f2fs: fix to do sanity check on F2FS\_INLINE\_DATA flag in inode during GC (CVSS 7.8, Linux)
- [CVE-2024-44941](https://cve.now/CVE-2024-44941.md): f2fs: fix to cover read extent cache access with lock (CVSS 7.8, Linux)
- [CVE-2024-44940](https://cve.now/CVE-2024-44940.md): fou: remove warn in gue\_gro\_receive on unsupported protocol (CVSS 7.5, Linux)
- [CVE-2024-44939](https://cve.now/CVE-2024-44939.md): jfs: fix null ptr deref in dtInsertEntry (CVSS 7.8, Linux)
- [CVE-2024-44938](https://cve.now/CVE-2024-44938.md): jfs: Fix shift-out-of-bounds in dbDiscardAG (no CVSS, Linux)
- [CVE-2024-44937](https://cve.now/CVE-2024-44937.md): platform/x86: intel-vbtn: Protect ACPI notify handler against recursion (no CVSS, Linux)
- [CVE-2024-44936](https://cve.now/CVE-2024-44936.md): power: supply: rt5033: Bring back i2c\_set\_clientdata (no CVSS, Linux)
- [CVE-2024-44935](https://cve.now/CVE-2024-44935.md): sctp: Fix null-ptr-deref in reuseport\_add\_sock(). (no CVSS, Linux)
- [CVE-2024-44934](https://cve.now/CVE-2024-44934.md): net: bridge: mcast: wait for previous gc cycles when removing port (CVSS 7.8, Linux)
- [CVE-2024-44933](https://cve.now/CVE-2024-44933.md): bnxt\_en : Fix memory out-of-bounds in bnxt\_fill\_hw\_rss\_tbl() (CVSS 7.3, Linux)
- [CVE-2024-44932](https://cve.now/CVE-2024-44932.md): idpf: fix UAFs when destroying the queues (no CVSS, Linux)
- [CVE-2024-44931](https://cve.now/CVE-2024-44931.md): gpio: prevent potential speculation leaks in gpio\_device\_get\_desc() (no CVSS, Linux)
- [CVE-2024-43914](https://cve.now/CVE-2024-43914.md): md/raid5: avoid BUG\_ON() while continue reshape after reassembling (no CVSS, Linux)
- [CVE-2024-43913](https://cve.now/CVE-2024-43913.md): nvme: apple: fix device reference counting (CVSS 7.0, Linux)
- [CVE-2024-43912](https://cve.now/CVE-2024-43912.md): wifi: nl80211: disallow setting special AP channel widths (no CVSS, Linux)
- [CVE-2024-43911](https://cve.now/CVE-2024-43911.md): wifi: mac80211: fix NULL dereference at band check in starting tx ba session (no CVSS, Linux)
- [CVE-2024-43910](https://cve.now/CVE-2024-43910.md): bpf: add missing check\_func\_arg\_reg\_off() to prevent out-of-bounds memory accesses (CVSS 7.8, Linux)
- [CVE-2024-43909](https://cve.now/CVE-2024-43909.md): drm/amdgpu/pm: Fix the null pointer dereference for smu7 (no CVSS, Linux)
- [CVE-2024-43908](https://cve.now/CVE-2024-43908.md): drm/amdgpu: Fix the null pointer dereference to ras\_manager (no CVSS, Linux)
- [CVE-2024-43907](https://cve.now/CVE-2024-43907.md): drm/amdgpu/pm: Fix the null pointer dereference in apply\_state\_adjust\_rules (no CVSS, Linux)
- [CVE-2024-43906](https://cve.now/CVE-2024-43906.md): drm/admgpu: fix dereferencing null pointer context (no CVSS, Linux)
- [CVE-2024-43905](https://cve.now/CVE-2024-43905.md): drm/amd/pm: Fix the null pointer dereference for vega10\_hwmgr (no CVSS, Linux)
- [CVE-2024-43904](https://cve.now/CVE-2024-43904.md): drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing (no CVSS, Linux)
- [CVE-2024-43902](https://cve.now/CVE-2024-43902.md): drm/amd/display: Add null checker before passing variables (no CVSS, Linux)
- [CVE-2024-43901](https://cve.now/CVE-2024-43901.md): drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401 (no CVSS, Linux)
- [CVE-2024-43900](https://cve.now/CVE-2024-43900.md): media: xc2028: avoid use-after-free in load\_firmware\_cb() (no CVSS, Linux)
- [CVE-2024-43899](https://cve.now/CVE-2024-43899.md): drm/amd/display: Fix null pointer deref in dcn20\_resource.c (no CVSS, Linux)
- [CVE-2024-43897](https://cve.now/CVE-2024-43897.md): net: drop bad gso csum\_start and offset in virtio\_net\_hdr (CVSS 7.8, Linux)
- [CVE-2024-43896](https://cve.now/CVE-2024-43896.md): ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get\_variable is NULL (no CVSS, Linux)
- [CVE-2024-43894](https://cve.now/CVE-2024-43894.md): drm/client: fix null pointer dereference in drm\_client\_modeset\_probe (no CVSS, Linux)
- [CVE-2024-43893](https://cve.now/CVE-2024-43893.md): serial: core: check uartclk for zero to avoid divide by zero (no CVSS, Linux)
- [CVE-2024-43892](https://cve.now/CVE-2024-43892.md): memcg: protect concurrent access to mem\_cgroup\_idr (CVSS 7.8, Linux)
- [CVE-2024-43891](https://cve.now/CVE-2024-43891.md): tracing: Have format file honor EVENT\_FILE\_FL\_FREED (CVSS 7.8, Linux)
- [CVE-2024-43890](https://cve.now/CVE-2024-43890.md): tracing: Fix overflow in get\_free\_elt() (no CVSS, Linux)
- [CVE-2024-43889](https://cve.now/CVE-2024-43889.md): padata: Fix possible divide-by-0 panic in padata\_mt\_helper() (no CVSS, Linux)
- [CVE-2024-43888](https://cve.now/CVE-2024-43888.md): mm: list\_lru: fix UAF for memory cgroup (CVSS 7.8, Linux)
- [CVE-2024-43887](https://cve.now/CVE-2024-43887.md): net/tcp: Disable TCP-AO static key after RCU grace period (no CVSS, Linux)
- [CVE-2024-43886](https://cve.now/CVE-2024-43886.md): drm/amd/display: Add null check in resource\_log\_pipe\_topology\_update (no CVSS, Linux)
- [CVE-2024-8161](https://cve.now/CVE-2024-8161.md): SQL injection vulnerability in CIGESv2 system (CVSS 9.8, CIGESv2)
- [CVE-2024-43444](https://cve.now/CVE-2024-43444.md): Passwords are written to Admin Log Module (CVSS 8.2, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2024-43443](https://cve.now/CVE-2024-43443.md): Stored XSS in process management (CVSS 4.9, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2024-43442](https://cve.now/CVE-2024-43442.md): Stored XSS in System Configuration (CVSS 4.9, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2024-43884](https://cve.now/CVE-2024-43884.md): Bluetooth: MGMT: Add error handling to pair\_device() (no CVSS, Linux)
- [CVE-2024-7313](https://cve.now/CVE-2024-7313.md): Shield Security \< 20.0.6 - Reflected XSS (CVSS 6.1, Shield Security)
- [CVE-2024-6879](https://cve.now/CVE-2024-6879.md): Quiz and Survey Master (QSM) \< 9.1.1 - Contributor+ Stored XSS (CVSS 4.7, Quiz and Survey Master)
- [CVE-2024-8073](https://cve.now/CVE-2024-8073.md): Command Injection Vulnerability in Hillstone Networks Web Application Firewall (CVSS 9.8, Hillstone Networks Web Application Firewall)
- [CVE-2024-28077](https://cve.now/CVE-2024-28077.md): A denial-of-service issue was discovered on certain GL-iNet devices. (CVSS 7.5)
- [CVE-2024-34087](https://cve.now/CVE-2024-34087.md): An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve r (CVSS 9.8)
- [CVE-2024-39097](https://cve.now/CVE-2024-39097.md): There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the \`url\` parameter in login path. (CVSS 6.1)
- [CVE-2024-41285](https://cve.now/CVE-2024-41285.md): A stack overflow in FAST FW300R v1.3.13 Build 141023 Rel.61347n allows attackers to execute arbitrary code or cause a Denial of Service (DoS (CVSS 9.8)
- [CVE-2024-41444](https://cve.now/CVE-2024-41444.md): SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so. (CVSS 9.8)
- [CVE-2024-41996](https://cve.now/CVE-2024-41996.md): Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote att (CVSS 7.5)
- [CVE-2024-42787](https://cve.now/CVE-2024-42787.md): A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save\_playlist" in Kashipara Music Management System v (CVSS 6.1)
- [CVE-2024-42788](https://cve.now/CVE-2024-42788.md): A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save\_music" in Kashipara Music Management System v1.0 (CVSS 6.1)
- [CVE-2024-42789](https://cve.now/CVE-2024-42789.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1. (CVSS 6.3)
- [CVE-2024-42790](https://cve.now/CVE-2024-42790.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. (CVSS 6.1)
- [CVE-2024-42791](https://cve.now/CVE-2024-42791.md): A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete\_genr (CVSS 8.8)
- [CVE-2024-42792](https://cve.now/CVE-2024-42792.md): A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete\_play (CVSS 3.5)
- [CVE-2024-42816](https://cve.now/CVE-2024-42816.md): A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary (CVSS 6.1, fastapi-admin)
- [CVE-2024-42818](https://cve.now/CVE-2024-42818.md): A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary w (CVSS 6.1, fastapi-admin)
- [CVE-2024-42906](https://cve.now/CVE-2024-42906.md): TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. (CVSS 4.1)
- [CVE-2024-42913](https://cve.now/CVE-2024-42913.md): RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job\_id parameter at /sasfs1. (CVSS 5.4)
- [CVE-2024-44549](https://cve.now/CVE-2024-44549.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv. (CVSS 6.6)
- [CVE-2024-44550](https://cve.now/CVE-2024-44550.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv. (CVSS 8.8)
- [CVE-2024-44551](https://cve.now/CVE-2024-44551.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv. (CVSS 9.8)
- [CVE-2024-44552](https://cve.now/CVE-2024-44552.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv. (CVSS 6.6)
- [CVE-2024-44553](https://cve.now/CVE-2024-44553.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv. (CVSS 8.8)
- [CVE-2024-44555](https://cve.now/CVE-2024-44555.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo. (CVSS 9.8)
- [CVE-2024-44556](https://cve.now/CVE-2024-44556.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo. (CVSS 6.6)
- [CVE-2024-44557](https://cve.now/CVE-2024-44557.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo. (CVSS 8.0)
- [CVE-2024-44558](https://cve.now/CVE-2024-44558.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo. (CVSS 8.8)
- [CVE-2024-44563](https://cve.now/CVE-2024-44563.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo. (CVSS 8.0)
- [CVE-2024-44565](https://cve.now/CVE-2024-44565.md): Tenda AX1806 v1.0.0.1 contains a stack overflow via the serverName parameter in the function form\_fast\_setting\_internet\_set. (CVSS 8.0)
- [CVE-2024-44793](https://cve.now/CVE-2024-44793.md): A cross-site scripting (XSS) vulnerability in the component /managers/multiple\_freeleech.php of Gazelle commit 63b3370 allows attackers to e (CVSS 6.1)
- [CVE-2024-44794](https://cve.now/CVE-2024-44794.md): A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers (CVSS 6.1)
- [CVE-2024-44795](https://cve.now/CVE-2024-44795.md): A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitr (CVSS 6.1)
- [CVE-2024-44796](https://cve.now/CVE-2024-44796.md): A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execut (CVSS 8.0)
- [CVE-2024-44797](https://cve.now/CVE-2024-44797.md): A cross-site scripting (XSS) vulnerability in the component /managers/enable\_requests.php of Gazelle commit 63b3370 allows attackers to exec (CVSS 5.4)
- [CVE-2024-45241](https://cve.now/CVE-2024-45241.md): A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated at (CVSS 7.5)
- [CVE-2024-45256](https://cve.now/CVE-2024-45256.md): An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite database (CVSS 9.8)
- [CVE-2024-45265](https://cve.now/CVE-2024-45265.md): A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL c (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.