# CVEs published 2024-09-25

101 CVEs were published on September 25, 2024: 9 critical, 38 high. Days are UTC.

- [CVE-2024-47083](https://cve.now/CVE-2024-47083.md): Power Platform Terraform Provider has Improper Masking of Secrets in Logs (CVSS 8.8, microsoft terraform-provider-power-platform)
- [CVE-2024-47082](https://cve.now/CVE-2024-47082.md): Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.6, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2024-47305](https://cve.now/CVE-2024-47305.md): WordPress Use Any Font plugin \<= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Dnesscarkey Use Any Font)
- [CVE-2024-47315](https://cve.now/CVE-2024-47315.md): WordPress GiveWP – Donation Plugin and Fundraising Platform plugin \<= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, StellarWP GiveWP)
- [CVE-2024-8996](https://cve.now/CVE-2024-8996.md): Grafana Agent Flow on Windows Unquoted service path (CVSS 7.3, Grafana Agent Flow · github.com/grafana/agent)
- [CVE-2024-8975](https://cve.now/CVE-2024-8975.md): Grafana Alloy on Windows Unquoted service path (CVSS 7.3, Grafana Alloy · github.com/grafana/alloy)
- [CVE-2024-20434](https://cve.now/CVE-2024-20434.md): A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on t (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2024-20414](https://cve.now/CVE-2024-20414.md): A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to con (CVSS 6.5, Cisco IOS)
- [CVE-2024-20465](https://cve.now/CVE-2024-20465.md): A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet 4000, 4010, and 5000 (CVSS 5.8, Cisco IOS)
- [CVE-2024-20510](https://cve.now/CVE-2024-20510.md): A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthentic (CVSS 4.7, Cisco IOS XE Software)
- [CVE-2024-20467](https://cve.now/CVE-2024-20467.md): A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, rem (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2024-20464](https://cve.now/CVE-2024-20464.md): A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2024-20480](https://cve.now/CVE-2024-20480.md): A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow a (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2024-20437](https://cve.now/CVE-2024-20437.md): A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a (CVSS 8.1, Cisco IOS XE Software)
- [CVE-2024-20436](https://cve.now/CVE-2024-20436.md): A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthentic (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2024-20433](https://cve.now/CVE-2024-20433.md): A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthent (CVSS 8.6, Cisco IOS)
- [CVE-2024-20496](https://cve.now/CVE-2024-20496.md): Cisco SD-WAN vEdge Routers Denial of Service Vulnerability (CVSS 6.1, Cisco SD-WAN vEdge Cloud · Cisco SD-WAN vEdge router)
- [CVE-2024-20475](https://cve.now/CVE-2024-20475.md): Cisco SD-WAN vManage Cross-Site Scripting Vulnerability (CVSS 6.4, Cisco Catalyst SD-WAN Manager)
- [CVE-2024-20508](https://cve.now/CVE-2024-20508.md): Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability (CVSS 5.8, Cisco UTD SNORT IPS Engine Software)
- [CVE-2024-20350](https://cve.now/CVE-2024-20350.md): Cisco Catalyst Center Static SSH Host Key Vulnerability (CVSS 7.5, Cisco Digital Network Architecture Center)
- [CVE-2024-20455](https://cve.now/CVE-2024-20455.md): A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense (UTD) component of Cisco IOS XE Software (CVSS 8.6, Cisco IOS XE Software · Cisco IOS XE Catalyst SD-WAN)
- [CVE-2024-47078](https://cve.now/CVE-2024-47078.md): Meshtastic firmware Authentication/Authorization Bypass via MQTT (CVSS 8.1, meshtastic firmware)
- [CVE-2024-7421](https://cve.now/CVE-2024-7421.md): An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to syste (CVSS 5.5, Devolutions Remote Desktop Manager)
- [CVE-2024-43237](https://cve.now/CVE-2024-43237.md): WordPress Tag Groups plugin \<= 2.0.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Steve Burge WordPress Tag Cloud Plugin – Tag Groups)
- [CVE-2024-43990](https://cve.now/CVE-2024-43990.md): WordPress Masterstudy LMS Starter theme \<= 1.1.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, StylemixThemes Masterstudy LMS Starter)
- [CVE-2024-43959](https://cve.now/CVE-2024-43959.md): WordPress Super Testimonials plugin \<= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Themepoints Testimonials)
- [CVE-2024-30128](https://cve.now/CVE-2024-30128.md): An open proxy vulnerability affects HCL Nomad server on Domino (CVSS 8.6, HCL Software Nomad server on Domino)
- [CVE-2024-8316](https://cve.now/CVE-2024-8316.md): Progress UI for WPF format provider unsafe deserialization vulnerability (CVSS 7.8, Progress Software Telerik UI for WPF)
- [CVE-2024-7576](https://cve.now/CVE-2024-7576.md): Progress UI for WPF format provider unsafe deserialization vulnerability (CVSS 7.8, Progress Software Telerik UI for WPF)
- [CVE-2024-7575](https://cve.now/CVE-2024-7575.md): Improper neutralization special element in hyperlinks (CVSS 7.8, Progress Software Telerik UI for WPF)
- [CVE-2024-6512](https://cve.now/CVE-2024-6512.md): Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users wit (CVSS 6.5, Devolutions Server)
- [CVE-2024-7679](https://cve.now/CVE-2024-7679.md): Improper neutralization special element in hyperlinks (CVSS 7.8, Progress Software Telerik UI for WinForms)
- [CVE-2024-45613](https://cve.now/CVE-2024-45613.md): CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package (CVSS 5.1, ckeditor5 · @ckeditor/ckeditor5-clipboard)
- [CVE-2024-8546](https://cve.now/CVE-2024-8546.md): ElementsKit Elementor addons \<= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2024-4657](https://cve.now/CVE-2024-4657.md): Strored XSS in Talent Software's BAP Automation (CVSS 9.3, Talent Software BAP Automation)
- [CVE-2024-6594](https://cve.now/CVE-2024-6594.md): WatchGuard Firebox Single Sign-On Client Denial-of-Service (CVSS 8.7, WatchGuard SSO Client)
- [CVE-2024-6593](https://cve.now/CVE-2024-6593.md): WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass (CVSS 9.3, WatchGuard SSO Agent)
- [CVE-2024-6592](https://cve.now/CVE-2024-6592.md): WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass (CVSS 9.3, WatchGuard SSO Client · WatchGuard SSO Agent)
- [CVE-2024-8858](https://cve.now/CVE-2024-8858.md): Elementor Addons by Livemesh \<= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart\_settings Parameter (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-7479](https://cve.now/CVE-2024-7479.md): Improper signature verification of VPN driver installation in TeamViewer Remote Clients (CVSS 8.8, TeamViewer Remote Full Client · TeamViewer Remote Host)
- [CVE-2024-7481](https://cve.now/CVE-2024-7481.md): Improper signature verification of Printer driver installation in TeamViewer Remote Clients (CVSS 8.8, TeamViewer Remote Full Client · TeamViewer Remote Host)
- [CVE-2024-45817](https://cve.now/CVE-2024-45817.md): x86: Deadlock in vlapic\_error() (CVSS 7.3, Xen)
- [CVE-2024-31146](https://cve.now/CVE-2024-31146.md): PCI device pass-through with shared resources (CVSS 7.5, Xen)
- [CVE-2024-31145](https://cve.now/CVE-2024-31145.md): error handling in x86 IOMMU identity mapping (CVSS 7.5, Xen)
- [CVE-2024-9169](https://cve.now/CVE-2024-9169.md): litespeed cache \<= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, litespeedtech LiteSpeed Cache)
- [CVE-2024-8175](https://cve.now/CVE-2024-8175.md): CODESYS: web server vulnerable to DoS (CVSS 7.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +16)
- [CVE-2024-47303](https://cve.now/CVE-2024-47303.md): WordPress Elementor Addons by Livemesh plugin \<= 8.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Livemesh Addons for Elementor)
- [CVE-2024-23454](https://cve.now/CVE-2024-23454.md): Apache Hadoop: Temporary File Local Information Disclosure (CVSS 6.2, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2024-40761](https://cve.now/CVE-2024-40761.md): Apache Answer: Avatar URL leaked user email addresses (CVSS 5.3, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2024-3866](https://cve.now/CVE-2024-3866.md): Ninja Forms Contact Form \<= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer (CVSS 4.7, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-8290](https://cve.now/CVE-2024-8290.md): WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible \<= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation (CVSS 8.8, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2024-8678](https://cve.now/CVE-2024-8678.md): Revolut Gateway for WooCommerce \<= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update (CVSS 5.3, revolutbusiness Revolut Gateway for WooCommerce)
- [CVE-2024-8910](https://cve.now/CVE-2024-8910.md): HT Mega – Absolute Addons For Elementor \<= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template\_id (CVSS 4.3, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-7892](https://cve.now/CVE-2024-7892.md): adstxt Plugin \<= 1.0.0 - Settings Update via CSRF (CVSS 4.3, adstxt Plugin)
- [CVE-2024-7878](https://cve.now/CVE-2024-7878.md): WP ULike \< 4.7.4 - Admin+ Stored XSS (CVSS 4.8, WP ULike)
- [CVE-2024-6845](https://cve.now/CVE-2024-6845.md): SmartSearchWP \< 2.4.6 - Unauthenticated OpenAI Key Disclosure (CVSS 5.3, Chatbot with ChatGPT WordPress)
- [CVE-2024-8658](https://cve.now/CVE-2024-8658.md): myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification \<= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade (CVSS 5.3, saadiqbal Points Management System For Gamification, Ranks,…)
- [CVE-2024-8275](https://cve.now/CVE-2024-8275.md): The Events Calendar \<= 6.6.4 - Unauthenticated SQL Injection (CVSS 9.8, stellarwp The Events Calendar)
- [CVE-2024-8668](https://cve.now/CVE-2024-8668.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-7385](https://cve.now/CVE-2024-7385.md): WordPress Simple HTML Sitemap \<= 3.1 - Authenticated (Admin+) SQL Injection (CVSS 9.1, ashishajani WP Simple HTML Sitemap)
- [CVE-2024-8516](https://cve.now/CVE-2024-8516.md): Themesflat Addons For Elementor \<= 2.2.1 - Authenticated (Contributor+) Information Exposure (CVSS 4.3, Themesflat Addons For Elementor)
- [CVE-2024-8514](https://cve.now/CVE-2024-8514.md): Prisna GWT - Google Website Translator \<= 1.4.11 - Authenticated (Admin+) PHP Object Injection (CVSS 9.1, Prisna GWT – Google Website Translator)
- [CVE-2024-8515](https://cve.now/CVE-2024-8515.md): Themesflat Addons For Elementor \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Themesflat Addons For Elementor)
- [CVE-2024-8350](https://cve.now/CVE-2024-8350.md): Uncanny Groups for LearnDash \<= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add (CVSS 2.7, Uncanny Owl Uncanny Groups for LearnDash)
- [CVE-2024-8349](https://cve.now/CVE-2024-8349.md): Uncanny Groups for LearnDash \<= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation (CVSS 7.2, Uncanny Owl Uncanny Groups for LearnDash)
- [CVE-2024-9073](https://cve.now/CVE-2024-9073.md): GutenGeek Free Gutenberg Blocks for WordPress \<= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wpopal GutenGeek Free Gutenberg Blocks for WordPress)
- [CVE-2024-7491](https://cve.now/CVE-2024-7491.md): HUSKY – Products Filter Professional for WooCommerce \<= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe (CVSS 5.3, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2024-6590](https://cve.now/CVE-2024-6590.md): Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. \<= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 6.3, javmah WPGSI: Spreadsheet Integration)
- [CVE-2024-8434](https://cve.now/CVE-2024-8434.md): Easy Mega Menu Plugin for WordPress – ThemeHunk \<= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates (CVSS 4.3, Easy Mega Menu for WordPress – ThemeHunk)
- [CVE-2024-8485](https://cve.now/CVE-2024-8485.md): REST API TO MiniProgram \<= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover (CVSS 9.8, xjb REST API TO MiniProgram)
- [CVE-2024-9024](https://cve.now/CVE-2024-9024.md): Material Design Icons \<= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode (CVSS 6.4, braginteractive Material Design Icons)
- [CVE-2024-9028](https://cve.now/CVE-2024-9028.md): WP GPX Maps \<= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode (CVSS 6.4, bastianonm WP GPX Maps)
- [CVE-2024-8621](https://cve.now/CVE-2024-8621.md): Daily Prayer Time \<= 2024.08.26 - Authenticated (Contributor+) SQL Injection (CVSS 9.9, mmrs151 Daily Prayer Time)
- [CVE-2024-8483](https://cve.now/CVE-2024-8483.md): MAS Static Content \<= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure (CVSS 4.3, madrasthemes MAS Static Content)
- [CVE-2024-8484](https://cve.now/CVE-2024-8484.md): REST API TO MiniProgram \<= 4.7.1 - Unauthenticated SQL Injection (CVSS 7.5, xjb REST API TO MiniProgram)
- [CVE-2024-8476](https://cve.now/CVE-2024-8476.md): Easy PayPal Events \<= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion (CVSS 4.3, scottpaterson Easy PayPal Events & Tickets)
- [CVE-2024-8713](https://cve.now/CVE-2024-8713.md): Kodex Posts likes \<= 2.5.0 - Reflected Cross-Site Scripting (CVSS 6.1, pierre-lebedel Kodex Posts likes)
- [CVE-2024-9068](https://cve.now/CVE-2024-9068.md): OneElements – Best Elementor Addons \<= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, themexclub OneElements – Best Elementor Addons)
- [CVE-2024-7617](https://cve.now/CVE-2024-7617.md): Contact Form to Any API \<= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Form (CVSS 7.2, itpathsolutions Contact Form to Any API)
- [CVE-2024-9069](https://cve.now/CVE-2024-9069.md): Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) \<= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, besnikac Graphicsly – The ultimate graphics plugin for Word…)
- [CVE-2024-8741](https://cve.now/CVE-2024-8741.md): Beam me up Scotty – Back to Top Button \<= 1.0.21 - Reflected Cross-Site Scripting (CVSS 6.1, outtheboxthemes Beam me up Scotty – Back to Top Button)
- [CVE-2024-7426](https://cve.now/CVE-2024-7426.md): Community by PeepSo – Social Network, Membership, Registration, User Profiles \<= 6.4.6.0 - Unauthenticated Full Path Disclosure (CVSS 5.3, Community by PeepSo – Download from PeepSo.com)
- [CVE-2024-9027](https://cve.now/CVE-2024-9027.md): WPZOOM Shortcodes \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode (CVSS 6.4, WPZOOM Shortcodes)
- [CVE-2024-8549](https://cve.now/CVE-2024-8549.md): Simple Calendar – Google Calendar Plugin \<= 3.4.2 - Reflected Cross-Site Scripting (CVSS 6.1, simplecalendar Simple Calendar – Google Calendar Plugin)
- [CVE-2024-8481](https://cve.now/CVE-2024-8481.md): Special Text Boxes \<= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, minimus Special Text Boxes)
- [CVE-2024-7386](https://cve.now/CVE-2024-7386.md): Premium Packages – Sell Digital Products Securely \<= 5.9.1 - Cross-Site Request Forgery (CVSS 4.3, codename065 Premium Packages – Sell Digital Products Secure…)
- [CVE-2023-25189](https://cve.now/CVE-2023-25189.md): BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web Element Manager, rega (CVSS 3.3)
- [CVE-2023-51157](https://cve.now/CVE-2023-51157.md): Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute arbitrary code and obtain sensitive inform (CVSS 5.4)
- [CVE-2024-22892](https://cve.now/CVE-2024-22892.md): OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords. (CVSS 7.5, openslides)
- [CVE-2024-22893](https://cve.now/CVE-2024-22893.md): OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. (CVSS 7.5, openslides)
- [CVE-2024-41445](https://cve.now/CVE-2024-41445.md): Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the ReadData function (CVSS 6.5)
- [CVE-2024-41708](https://cve.now/CVE-2024-41708.md): An issue was discovered in AdaCore ada\_web\_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random\_String( (CVSS 7.5)
- [CVE-2024-44678](https://cve.now/CVE-2024-44678.md): Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection. (CVSS 8.0)
- [CVE-2024-44825](https://cve.now/CVE-2024-44825.md): Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitr (CVSS 7.5)
- [CVE-2024-45750](https://cve.now/CVE-2024-45750.md): An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterp (CVSS 7.3)
- [CVE-2024-46461](https://cve.now/CVE-2024-46461.md): VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a malicious (CVSS 8.0)
- [CVE-2024-46485](https://cve.now/CVE-2024-46485.md): dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate (CVSS 6.3)
- [CVE-2024-46488](https://cve.now/CVE-2024-46488.md): sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy\_token\_next function. (CVSS 9.1, sqlite-vec)
- [CVE-2024-46489](https://cve.now/CVE-2024-46489.md): A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL. (CVSS 8.8, @ifnotnowwhen/promptr)
- [CVE-2024-46600](https://cve.now/CVE-2024-46600.md): dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.php?act=delCate&id=31 (CVSS 4.7)
- [CVE-2024-46655](https://cve.now/CVE-2024-46655.md): A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a us (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.