# CVEs published 2024-09-28

29 CVEs were published on September 28, 2024: 1 critical, 6 high. Days are UTC.

- [CVE-2024-9319](https://cve.now/CVE-2024-9319.md): SourceCodester Online Timesheet App delete-timesheet.php sql injection (CVSS 5.3, SourceCodester Online Timesheet App)
- [CVE-2024-9318](https://cve.now/CVE-2024-9318.md): SourceCodester Advocate Office Management System activate.php sql injection (CVSS 5.3, SourceCodester Advocate Office Management System)
- [CVE-2024-9317](https://cve.now/CVE-2024-9317.md): SourceCodester Online Eyewear Shop Master.php delete\_category sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9316](https://cve.now/CVE-2024-9316.md): code-projects Blood Bank Management System B+.php sql injection (CVSS 5.3, code-projects Blood Bank Management System)
- [CVE-2024-9315](https://cve.now/CVE-2024-9315.md): SourceCodester Employee and Visitor Gate Pass Logging System manage\_department.php sql injection (CVSS 5.3, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-9300](https://cve.now/CVE-2024-9300.md): SourceCodester Online Railway Reservation System Message Us Form contact\_us.php cross site scripting (CVSS 6.9, SourceCodester Online Railway Reservation System)
- [CVE-2024-9299](https://cve.now/CVE-2024-9299.md): SourceCodester Online Railway Reservation System ?page=reserve cross site scripting (CVSS 5.3, SourceCodester Online Railway Reservation System)
- [CVE-2024-9298](https://cve.now/CVE-2024-9298.md): SourceCodester Online Railway Reservation System Ticket ?page=tickets access control (CVSS 5.3, SourceCodester Online Railway Reservation System)
- [CVE-2024-8189](https://cve.now/CVE-2024-8189.md): WP MultiTasking - WP Utilities \<= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, thangnv27 WP MultiTasking – WP Utilities)
- [CVE-2024-9297](https://cve.now/CVE-2024-9297.md): SourceCodester Online Railway Reservation System admin improper authorization (CVSS 5.3, SourceCodester Online Railway Reservation System)
- [CVE-2024-9296](https://cve.now/CVE-2024-9296.md): SourceCodester Advocate Office Management System forgot\_pass.php sql injection (CVSS 6.9, SourceCodester Advocate Office Management System)
- [CVE-2024-8712](https://cve.now/CVE-2024-8712.md): GTM Server Side \<= 2.1.19 - Reflected Cross-Site Scripting (CVSS 6.1, gtmserver Stape Conversion Tracking)
- [CVE-2024-9295](https://cve.now/CVE-2024-9295.md): SourceCodester Advocate Office Management System login.php sql injection (CVSS 6.9, SourceCodester Advocate Office Management System)
- [CVE-2024-23923](https://cve.now/CVE-2024-23923.md): Alpine Halo9 prh\_l2\_sar\_data\_ind Use-After-Free Remote Code Execution Vulnerability (CVSS 8.8, Alpine Halo9)
- [CVE-2024-23960](https://cve.now/CVE-2024-23960.md): Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability (CVSS 4.6, Alpine Halo9)
- [CVE-2024-23924](https://cve.now/CVE-2024-23924.md): Alpine Halo9 UPDM\_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability (CVSS 6.8, Alpine Halo9)
- [CVE-2024-23961](https://cve.now/CVE-2024-23961.md): Alpine Halo9 UPDM\_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability (CVSS 6.8, Alpine Halo9)
- [CVE-2024-23959](https://cve.now/CVE-2024-23959.md): Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Autel MaxiCharger AC Elite Business C50)
- [CVE-2024-23935](https://cve.now/CVE-2024-23935.md): Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Alpine Halo9)
- [CVE-2024-23967](https://cve.now/CVE-2024-23967.md): Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Autel MaxiCharger AC Elite Business C50)
- [CVE-2024-23958](https://cve.now/CVE-2024-23958.md): Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability (CVSS 6.5, Autel MaxiCharger AC Elite Business C50)
- [CVE-2024-23957](https://cve.now/CVE-2024-23957.md): Autel MaxiCharger AC Elite Business C50 DLB\_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Autel MaxiCharger AC Elite Business C50)
- [CVE-2024-23938](https://cve.now/CVE-2024-23938.md): Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Silicon Labs Gecko OS)
- [CVE-2024-8715](https://cve.now/CVE-2024-8715.md): Simple LDAP Login \<= 1.6.0 - Reflected Cross-Site Scripting (CVSS 6.1, clifgriffin Simple LDAP Login)
- [CVE-2024-9189](https://cve.now/CVE-2024-9189.md): EU/UK VAT Manager for WooCommerce \<= 2.12.12 - Missing Authorization (CVSS 5.3, wpcodefactory EU/UK VAT Validation Manager for WooCommerce)
- [CVE-2024-8353](https://cve.now/CVE-2024-8353.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.16.1 - Unauthenticated PHP Object Injection (CVSS 9.8, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-9023](https://cve.now/CVE-2024-9023.md): WP-WebAuthn \<= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa\_login\_form Shortcode (CVSS 6.4, axton WP-WebAuthn)
- [CVE-2024-8788](https://cve.now/CVE-2024-8788.md): EU/UK VAT Manager for WooCommerce \<= 2.12.12 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory EU/UK VAT Validation Manager for WooCommerce)
- [CVE-2024-8547](https://cve.now/CVE-2024-8547.md): Simple Popup Plugin \<= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, grimmdude Simple Popup Plugin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.