# CVEs published 2024-09-15

27 CVEs were published on September 15, 2024: 3 critical, 5 high. Days are UTC.

- [CVE-2024-8876](https://cve.now/CVE-2024-8876.md): xiaohe4966 TpMeCMS lang path traversal (CVSS 5.3, xiaohe4966 TpMeCMS)
- [CVE-2024-8875](https://cve.now/CVE-2024-8875.md): vedees wcms finder.php path traversal (CVSS 5.3, vedees wcms)
- [CVE-2024-8869](https://cve.now/CVE-2024-8869.md): TOTOLINK A720R exportOvpn os command injection (CVSS 2.3, TOTOLINK A720R)
- [CVE-2024-44053](https://cve.now/CVE-2024-44053.md): WordPress Opor Ayam theme \<= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mohammad Arif Opor Ayam)
- [CVE-2024-44054](https://cve.now/CVE-2024-44054.md): WordPress Fluida theme \<= 1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Fluida)
- [CVE-2024-44056](https://cve.now/CVE-2024-44056.md): WordPress Mantra theme \<= 3.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Mantra)
- [CVE-2024-44057](https://cve.now/CVE-2024-44057.md): WordPress Nirvana theme \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Nirvana)
- [CVE-2024-44058](https://cve.now/CVE-2024-44058.md): WordPress Parabola theme \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Parabola)
- [CVE-2024-44059](https://cve.now/CVE-2024-44059.md): WordPress Custom Query Blocks plugin \<= 5.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ronald Huereca Custom Query Blocks)
- [CVE-2024-44060](https://cve.now/CVE-2024-44060.md): WordPress filmix theme \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jennifer Hall Filmix)
- [CVE-2024-44062](https://cve.now/CVE-2024-44062.md): WordPress Custom Field Template plugin \<= 2.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hiroaki Miyashita Custom Field Template)
- [CVE-2024-44063](https://cve.now/CVE-2024-44063.md): WordPress Happyforms plugin \<= 1.26.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Happyforms)
- [CVE-2024-45455](https://cve.now/CVE-2024-45455.md): WordPress WP Meta SEO plugin \<= 4.5.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, JoomUnited WP Meta SEO)
- [CVE-2024-45456](https://cve.now/CVE-2024-45456.md): WordPress WP Meta SEO plugin \<= 4.5.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, JoomUnited WP Meta SEO)
- [CVE-2024-45457](https://cve.now/CVE-2024-45457.md): WordPress Spiffy Calendar plugin \<= 4.9.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Spiffy Plugins Spiffy Calendar)
- [CVE-2024-45458](https://cve.now/CVE-2024-45458.md): WordPress Spiffy Calendar plugin \<= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Spiffy Plugins Spiffy Calendar)
- [CVE-2024-45459](https://cve.now/CVE-2024-45459.md): WordPress Product Slider for WooCommerce by PickPlugins plugin \<= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PickPlugins Product Slider for WooCommerce)
- [CVE-2024-45460](https://cve.now/CVE-2024-45460.md): WordPress Flipping Cards plugin \<= 1.30 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, manu225 Flipping Cards)
- [CVE-2024-8868](https://cve.now/CVE-2024-8868.md): code-projects Crud Operation System savedata.php sql injection (CVSS 6.9, code-projects Crud Operation System)
- [CVE-2024-8867](https://cve.now/CVE-2024-8867.md): Perfex CRM Parameter Clients.php cross site scripting (CVSS 5.3, Perfex CRM)
- [CVE-2024-8866](https://cve.now/CVE-2024-8866.md): AutoCMS robot.php cross site scripting (CVSS 6.9, AutoCMS)
- [CVE-2024-8865](https://cve.now/CVE-2024-8865.md): composiohq composio api.py path path traversal (CVSS 5.1, composiohq composio · composio-core)
- [CVE-2024-8864](https://cve.now/CVE-2024-8864.md): composiohq composio calculator.py Calculator code injection (CVSS 5.1, composiohq composio · composio-core)
- [CVE-2024-46918](https://cve.now/CVE-2024-46918.md): app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of a (CVSS 9.8)
- [CVE-2024-46938](https://cve.now/CVE-2024-46938.md): An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release thro (CVSS 7.5)
- [CVE-2024-46942](https://cve.now/CVE-2024-46942.md): In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries (CVSS 9.1, org.opendaylight.mdsal:mdsal-artifacts)
- [CVE-2024-46943](https://cve.now/CVE-2024-46943.md): An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. (CVSS 9.1, org.opendaylight.aaa:aaa-artifacts)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.