# CVEs published 2024-09-22

20 CVEs were published on September 22, 2024: 1 critical, 2 high. Days are UTC.

- [CVE-2024-43989](https://cve.now/CVE-2024-43989.md): WordPress Justified Image Grid plugin \<= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability (CVSS 7.5, Firsh Justified Image Grid)
- [CVE-2024-9090](https://cve.now/CVE-2024-9090.md): SourceCodester Modern Loan Management System search\_member.php sql injection (CVSS 5.3, SourceCodester Modern Loan Management System)
- [CVE-2024-9089](https://cve.now/CVE-2024-9089.md): SourceCodester Modern Loan Management System update\_loan\_record.php cross site scripting (CVSS 5.3, SourceCodester Modern Loan Management System)
- [CVE-2024-9088](https://cve.now/CVE-2024-9088.md): SourceCodester Telecom Billing Management System login buffer overflow (CVSS 5.3, SourceCodester Telecom Billing Management System)
- [CVE-2024-9087](https://cve.now/CVE-2024-9087.md): code-projects Vehicle Management edit1.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2024-9086](https://cve.now/CVE-2024-9086.md): code-projects Restaurant Reservation System filter.php sql injection (CVSS 5.3, code-projects Restaurant Reservation System)
- [CVE-2024-40703](https://cve.now/CVE-2024-40703.md): IBM Cognos Analytics information disclosure (CVSS 5.5, IBM Cognos Analytics)
- [CVE-2024-9084](https://cve.now/CVE-2024-9084.md): code-projects Blood Bank System bbms.php cross site scripting (CVSS 5.3, code-projects Blood Bank System)
- [CVE-2024-9083](https://cve.now/CVE-2024-9083.md): SourceCodester Employee Management System add-admin.php cross site scripting (CVSS 5.1, SourceCodester Employee Management System)
- [CVE-2024-9082](https://cve.now/CVE-2024-9082.md): SourceCodester Online Eyewear Shop User Creation Users.php improper authorization (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9085](https://cve.now/CVE-2024-9085.md): code-projects Restaurant Reservation System index.php sql injection (CVSS 6.9, code-projects Restaurant Reservation System)
- [CVE-2024-9081](https://cve.now/CVE-2024-9081.md): SourceCodester Online Eyewear Shop view\_category.php sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9080](https://cve.now/CVE-2024-9080.md): code-projects Student Record System pincode-verification.php sql injection (CVSS 6.9, code-projects Student Record System)
- [CVE-2024-9079](https://cve.now/CVE-2024-9079.md): code-projects Student Record System marks.php sql injection (CVSS 6.9, code-projects Student Record System)
- [CVE-2024-9078](https://cve.now/CVE-2024-9078.md): code-projects Student Record System course.php sql injection (CVSS 6.9, code-projects Student Record System)
- [CVE-2024-9077](https://cve.now/CVE-2024-9077.md): dingfangzu Order Checkout order.js cross site scripting (CVSS 5.3, dingfangzu)
- [CVE-2024-9076](https://cve.now/CVE-2024-9076.md): DedeCMS article\_string\_mix.php os command injection (CVSS 5.1, DedeCMS)
- [CVE-2024-47218](https://cve.now/CVE-2024-47218.md): An issue was discovered in vesoft NebulaGraph through 3.8.0. (CVSS 9.8, github.com/vesoft-inc/nebula)
- [CVE-2024-47221](https://cve.now/CVE-2024-47221.md): CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password. (CVSS 7.5)
- [CVE-2024-47226](https://cve.now/CVE-2024-47226.md): A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via (CVSS 5.4, pynetbox)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.