# CVEs published 2024-09-17

105 CVEs were published on September 17, 2024: 9 critical, 36 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2024-43970](https://cve.now/CVE-2024-43970.md): WordPress SureCart plugin \<= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SureCart)
- [CVE-2024-43971](https://cve.now/CVE-2024-43971.md): WordPress Sunshine Photo Cart plugin \<= 3.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-43972](https://cve.now/CVE-2024-43972.md): WordPress Page Builder: Pagelayer – Drag and Drop website builder plugin \<= 1.8.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pagelayer Team PageLayer)
- [CVE-2024-43975](https://cve.now/CVE-2024-43975.md): WordPress Super Store Finder plugin \<= 6.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, highwarden Super Store Finder)
- [CVE-2024-43983](https://cve.now/CVE-2024-43983.md): WordPress Podlove Podcast Publisher plugin \<= 4.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Podlove Podcast Publisher)
- [CVE-2024-43987](https://cve.now/CVE-2024-43987.md): WordPress Sliding Door theme \<= 3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wayneconnor Sliding Door)
- [CVE-2024-43988](https://cve.now/CVE-2024-43988.md): WordPress Mystique theme \<= 2.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, digitalnature Mystique)
- [CVE-2024-43991](https://cve.now/CVE-2024-43991.md): WordPress Hotel Galaxy theme \<= 4.4.24 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webdzier Hotel Galaxy)
- [CVE-2024-43992](https://cve.now/CVE-2024-43992.md): WordPress LatePoint plugin \<= 4.9.91 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LatePoint)
- [CVE-2024-43993](https://cve.now/CVE-2024-43993.md): WordPress Liquido theme \<= 1.0.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Liquido)
- [CVE-2024-43994](https://cve.now/CVE-2024-43994.md): WordPress Kahuna theme \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Kahuna)
- [CVE-2024-43995](https://cve.now/CVE-2024-43995.md): WordPress Posterity theme \<= 3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 Posterity)
- [CVE-2024-43999](https://cve.now/CVE-2024-43999.md): WordPress Ninja Forms plugin \<= 3.8.11 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Saturday Drive Ninja Forms)
- [CVE-2024-44001](https://cve.now/CVE-2024-44001.md): WordPress Royal Elementor Addons and Templates plugin \<= 1.3.982 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Royal Royal Elementor Addons)
- [CVE-2024-44002](https://cve.now/CVE-2024-44002.md): WordPress Team Showcase plugin \<= 1.22.25 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PickPlugins Team Showcase)
- [CVE-2024-44003](https://cve.now/CVE-2024-44003.md): WordPress Spice Starter Sites plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, spicethemes Spice Starter Sites)
- [CVE-2024-44005](https://cve.now/CVE-2024-44005.md): WordPress Greenshift plugin \<= 9.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpsoul Greenshift)
- [CVE-2024-44007](https://cve.now/CVE-2024-44007.md): WordPress SKT Templates – Elementor & Gutenberg templates plugin \<= 6.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sonalsinha21 SKT Templates – Elementor & Gutenberg templates)
- [CVE-2024-44008](https://cve.now/CVE-2024-44008.md): WordPress Geo Mashup plugin \<= 1.13.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Dylan Kuhn Geo Mashup)
- [CVE-2024-44009](https://cve.now/CVE-2024-44009.md): WordPress WCFM Marketplace \<= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WC Lovers WCFM Marketplace)
- [CVE-2024-44047](https://cve.now/CVE-2024-44047.md): WordPress IMPress for IDX Broker plugin \<= 3.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, IMPress for IDX Broker)
- [CVE-2024-44049](https://cve.now/CVE-2024-44049.md): WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin \<= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeHunk Gutenberg Blocks)
- [CVE-2024-43938](https://cve.now/CVE-2024-43938.md): WordPress Name Directory plugin \<= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jeroen Peters Name Directory)
- [CVE-2024-43985](https://cve.now/CVE-2024-43985.md): WordPress Bus Ticket Booking with Seat Reservation plugin \<= 5.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, MagePeople Team Bus Ticket Booking with Seat Reservation)
- [CVE-2024-43977](https://cve.now/CVE-2024-43977.md): WordPress The Plus Addons for Elementor plugin \<= 5.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite)
- [CVE-2024-44064](https://cve.now/CVE-2024-44064.md): WordPress Like Button Rating LikeBtn plugin \<= 2.6.53 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LikeBtn Like Button Rating)
- [CVE-2024-43969](https://cve.now/CVE-2024-43969.md): WordPress Spiffy Calendar plugin \<= 4.9.12 - SQL Injection vulnerability (CVSS 7.6, Spiffy Plugins Spiffy Calendar)
- [CVE-2024-37985](https://cve.now/CVE-2024-37985.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2024-43976](https://cve.now/CVE-2024-43976.md): WordPress Super Store Finder plugin \<= 6.9.7 - SQL Injection vulnerability (CVSS 9.3, highwarden Super Store Finder)
- [CVE-2024-43978](https://cve.now/CVE-2024-43978.md): WordPress Super Store Finder plugin \< 6.9.8 - SQL Injection vulnerability (CVSS 9.3, highwarden Super Store Finder)
- [CVE-2024-44004](https://cve.now/CVE-2024-44004.md): WordPress WPCargo Track & Trace plugin \<= 8.0.2 - SQL Injection vulnerability (CVSS 9.3, Arni Cinco WPCargo Track & Trace)
- [CVE-2024-44050](https://cve.now/CVE-2024-44050.md): WordPress Verbosa theme \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cryout-creations Verbosa)
- [CVE-2024-44051](https://cve.now/CVE-2024-44051.md): WordPress Content Blocks (Custom Post Widget) plugin \<= 3.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Johan van der Wijk Content Blocks)
- [CVE-2024-45451](https://cve.now/CVE-2024-45451.md): WordPress Roseta theme \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cryout-creations Roseta)
- [CVE-2024-45452](https://cve.now/CVE-2024-45452.md): WordPress Septera theme \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cryout-creations Septera)
- [CVE-2024-46982](https://cve.now/CVE-2024-46982.md): Cache Poisoning in next.js (CVSS 7.5, vercel next.js · next)
- [CVE-2024-8909](https://cve.now/CVE-2024-8909.md): Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2024-8908](https://cve.now/CVE-2024-8908.md): Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a craf (CVSS 4.3, Google Chrome)
- [CVE-2024-8907](https://cve.now/CVE-2024-8907.md): Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to (CVSS 6.1, Google Chrome)
- [CVE-2024-8906](https://cve.now/CVE-2024-8906.md): Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in speci (CVSS 4.3, Google Chrome)
- [CVE-2024-8905](https://cve.now/CVE-2024-8905.md): Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption (CVSS 8.8, Google Chrome)
- [CVE-2024-8904](https://cve.now/CVE-2024-8904.md): Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-45815](https://cve.now/CVE-2024-45815.md): Prototype pollution in @backstage/plugin-catalog-backend (CVSS 6.5, backstage · @backstage/plugin-catalog-backend)
- [CVE-2024-45816](https://cve.now/CVE-2024-45816.md): Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend (CVSS 6.5, backstage · @backstage/plugin-techdocs-backend)
- [CVE-2024-46976](https://cve.now/CVE-2024-46976.md): Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend (CVSS 6.5, backstage · @backstage/plugin-techdocs-backend)
- [CVE-2024-8957](https://cve.now/CVE-2024-8957.md): PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration (CVSS 7.2, KEV, PTZOptics PT30X-SDI · PTZOptics PT30X-NDI)
- [CVE-2024-45812](https://cve.now/CVE-2024-45812.md): DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite (CVSS 6.4, vitejs vite · vite)
- [CVE-2024-45811](https://cve.now/CVE-2024-45811.md): server.fs.deny bypassed when using ?import&raw in vite (CVSS 4.8, vitejs vite · vite)
- [CVE-2024-8951](https://cve.now/CVE-2024-8951.md): SourceCodester Resort Reservation System manage\_fee.php cross site scripting (CVSS 5.3, SourceCodester Resort Reservation System)
- [CVE-2024-8956](https://cve.now/CVE-2024-8956.md): PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication (CVSS 9.1, KEV, PTZOptics PT30X-SDI · PTZOptics PT30X-NDI)
- [CVE-2024-45604](https://cve.now/CVE-2024-45604.md): Directory traversal in the file selector widget in contao/core-bundle (CVSS 4.3, contao · contao/core-bundle)
- [CVE-2024-45398](https://cve.now/CVE-2024-45398.md): Remote command execution through file upload in contao/core-bundle (CVSS 8.3, contao · contao/core-bundle)
- [CVE-2024-45605](https://cve.now/CVE-2024-45605.md): Improper authorization on deletion of user issue alert notifications in sentry (CVSS 6.5, getsentry sentry · sentry)
- [CVE-2024-45606](https://cve.now/CVE-2024-45606.md): Improper authorization on muting of alert rules in sentry (CVSS 7.1, getsentry sentry · sentry)
- [CVE-2024-8949](https://cve.now/CVE-2024-8949.md): SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-8948](https://cve.now/CVE-2024-8948.md): MicroPython objint.c mpz\_as\_bytes heap-based overflow (CVSS 6.9, MicroPython · micropython-os +2)
- [CVE-2024-45537](https://cve.now/CVE-2024-45537.md): Apache Druid: Users can provide MySQL JDBC properties not on allow list (CVSS 6.5, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2024-45384](https://cve.now/CVE-2024-45384.md): Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack (CVSS 5.3, Apache Software Foundation Apache Druid · org.apache.druid.…)
- [CVE-2024-8947](https://cve.now/CVE-2024-8947.md): MicroPython objarray.c use after free (CVSS 6.3, MicroPython · micropython-io +1)
- [CVE-2024-8946](https://cve.now/CVE-2024-8946.md): MicroPython VFS Unmount vfs.c mp\_vfs\_umount heap-based overflow (CVSS 6.9, MicroPython · micropython-string +3)
- [CVE-2024-45612](https://cve.now/CVE-2024-45612.md): Insert tag injection via canonical URL in Contao (CVSS 5.3, contao · contao/core-bundle)
- [CVE-2024-45803](https://cve.now/CVE-2024-45803.md): Cross site scripting (XSS) Vulnerability on route /wireui/button?label=Content in wireui (CVSS 5.1, wireui · wireui/wireui)
- [CVE-2024-43460](https://cve.now/CVE-2024-43460.md): Dynamics 365 Business Central Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Dynamics 365 Business Central Online)
- [CVE-2024-38183](https://cve.now/CVE-2024-38183.md): GroupMe Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft GroupMe)
- [CVE-2024-8900](https://cve.now/CVE-2024-8900.md): An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-8660](https://cve.now/CVE-2024-8660.md): Stored XSS in the "Top Navigator Bar" block (CVSS 4.6, Concrete CMS · concrete5/concrete5)
- [CVE-2024-45798](https://cve.now/CVE-2024-45798.md): Multiple Poisoned Pipeline Execution (PPE) vulnerabilities (CVSS 10.0, espressif arduino-esp32)
- [CVE-2024-8945](https://cve.now/CVE-2024-8945.md): CodeCanyon RISE Ultimate Project Manager save sql injection (CVSS 5.3, CodeCanyon RISE Ultimate Project Manager)
- [CVE-2024-8944](https://cve.now/CVE-2024-8944.md): code-projects Hospital Management System check\_availability.php sql injection (CVSS 6.9, code-projects Hospital Management System)
- [CVE-2024-42503](https://cve.now/CVE-2024-42503.md): Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI) (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba OS)
- [CVE-2024-38380](https://cve.now/CVE-2024-38380.md): Millbeck Communications Proroute H685t-w Cross-site Scripting. (CVSS 5.5, Millbeck Communications Proroute H685t-w)
- [CVE-2024-42502](https://cve.now/CVE-2024-42502.md): Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba OS)
- [CVE-2024-42501](https://cve.now/CVE-2024-42501.md): Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE) (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba OS)
- [CVE-2024-45682](https://cve.now/CVE-2024-45682.md): Millbeck Communications Proroute H685t-w Command Injection. (CVSS 8.8, Millbeck Communications Proroute H685t-w)
- [CVE-2024-38813](https://cve.now/CVE-2024-38813.md): Privilege escalation vulnerability (CVSS 7.5, KEV, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2024-38812](https://cve.now/CVE-2024-38812.md): Heap-overflow vulnerability (CVSS 9.8, KEV, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2024-8796](https://cve.now/CVE-2024-8796.md): Insufficient Default OTP Shared Secret Length (CVSS 6.0, devise-two-factor)
- [CVE-2024-8939](https://cve.now/CVE-2024-8939.md): Vllm: denials of service in vllm json web api (CVSS 6.2, vllm · Red Hat Enterprise Linux AI)
- [CVE-2024-8768](https://cve.now/CVE-2024-8768.md): Vllm: a completions api request with an empty prompt will crash the vllm api server. (CVSS 7.5, vllm · Red Hat Enterprise Linux AI)
- [CVE-2024-7788](https://cve.now/CVE-2024-7788.md): Signatures in "repair mode" should not be trusted (CVSS 7.8, The Document Foundation LibreOffice)
- [CVE-2021-27916](https://cve.now/CVE-2021-27916.md): Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) (CVSS 8.1, Mautic · mautic/core)
- [CVE-2021-27915](https://cve.now/CVE-2021-27915.md): XSS Cross-site Scripting Stored (XSS) - Description field (CVSS 7.6, Mautic · mautic/core)
- [CVE-2024-38860](https://cve.now/CVE-2024-38860.md): Reflected links in error message facilitate phishing attacks (CVSS 5.1, Checkmk)
- [CVE-2024-22303](https://cve.now/CVE-2024-22303.md): WordPress Houzez theme \<= 3.2.4 - Privilege Escalation vulnerability (CVSS 8.8, favethemes Houzez)
- [CVE-2024-21743](https://cve.now/CVE-2024-21743.md): WordPress Houzez Login Register plugin \<= 3.2.5 - Privilege Escalation vulnerability (CVSS 8.8, favethemes Houzez Login Register)
- [CVE-2024-7873](https://cve.now/CVE-2024-7873.md): Stored XSS in Veribilim Software's Veribase Order Management (CVSS 9.4, Veribilim Software Veribase Order)
- [CVE-2024-8897](https://cve.now/CVE-2024-8897.md): Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be (CVSS 6.1, Mozilla Firefox for Android)
- [CVE-2024-5998](https://cve.now/CVE-2024-5998.md): Deserialization of Untrusted Data in langchain-ai/langchain (CVSS 5.2, langchain-ai/langchain · langchain-community +1)
- [CVE-2024-8767](https://cve.now/CVE-2024-8767.md): Sensitive data disclosure and manipulation due to unnecessary privileges assignment. (CVSS 9.9, Acronis Backup plugin for cPanel & WHM · Acronis Backup… +1)
- [CVE-2024-8761](https://cve.now/CVE-2024-8761.md): Share This Image \<= 2.03 - Open Redirect via link Parameter (CVSS 7.2, mihail-barinov Share This Image)
- [CVE-2024-8490](https://cve.now/CVE-2024-8490.md): PropertyHive \<= 2.0.19 - Cross-Site Request Forgery via save\_account\_details (CVSS 8.8, propertyhive Property Hive)
- [CVE-2024-8093](https://cve.now/CVE-2024-8093.md): Posts reminder \<= 0.20 - Settings Update via CSRF (CVSS 4.8, Posts reminder)
- [CVE-2024-8092](https://cve.now/CVE-2024-8092.md): Accordion Image Menu \<= 3.1.3 - Stored XSS via CSRF (CVSS 5.4, Accordion Image Menu)
- [CVE-2024-8091](https://cve.now/CVE-2024-8091.md): Enhanced Search Box \<= 0.6.1 - Settings Update via CSRF (CVSS 4.8, Enhanced Search Box)
- [CVE-2024-8052](https://cve.now/CVE-2024-8052.md): Review Ratings \<= 1.6 - Stored XSS via CSRF (CVSS 4.8, Review Ratings)
- [CVE-2024-8051](https://cve.now/CVE-2024-8051.md): Special Feed Items \<= 1.0.1 - Stored XSS via CSRF (CVSS 5.7, Special Feed Items)
- [CVE-2024-8047](https://cve.now/CVE-2024-8047.md): Visual Sound (old) \<= 1.06 - Settings Update via CSRF (CVSS 5.7, Visual Sound)
- [CVE-2024-8044](https://cve.now/CVE-2024-8044.md): infolinks Ad Wrap \<= 1.0.2 - Settings Update via CSRF (CVSS 5.7, infolinks Ad Wrap)
- [CVE-2024-8043](https://cve.now/CVE-2024-8043.md): Vikinghammer Tweet \<= 0.2.4 - Stored XSS via CSRF (CVSS 5.7, Vikinghammer Tweet)
- [CVE-2024-5170](https://cve.now/CVE-2024-5170.md): Logo Manager For Enamad \<= 0.7.1 - Admin+ Stored XSS via Widget (CVSS 5.7, Logo Manager For Enamad)
- [CVE-2024-8110](https://cve.now/CVE-2024-8110.md): Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer. (CVSS 7.5, Yokogawa Electric Dual-redundant Platform for Computer)
- [CVE-2024-46085](https://cve.now/CVE-2024-46085.md): FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file\_manager/rename (CVSS 8.8)
- [CVE-2024-46362](https://cve.now/CVE-2024-46362.md): FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file\_manager/create\_directory (CVSS 8.8)
- [CVE-2024-47047](https://cve.now/CVE-2024-47047.md): An issue was discovered in the powermail extension through 12.4.0 for TYPO3. (CVSS 7.5, in2code/powermail)
- [CVE-2024-47049](https://cve.now/CVE-2024-47049.md): The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl (CVSS 8.2, czim/file-handling)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.